@flopay/js 1.4.3 → 1.4.4

package/dist/index.cjs

@@ -1,3759 +1 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/index.ts
-var index_exports = {};
-__export(index_exports, {
-  FloPay: () => FloPay,
-  FloPayElements: () => FloPayElements,
-  PaymentAPI: () => PaymentAPI,
-  PciVaultCardCapture: () => PciVaultCardCapture,
-  StripeAdapter: () => StripeAdapter,
-  cacheSessionDisplayData: () => cacheSessionDisplayData,
-  clearSessionDisplayData: () => clearSessionDisplayData,
-  createCheckoutSession: () => createCheckoutSession,
-  createCheckoutSessionWithRetries: () => createCheckoutSessionWithRetries,
-  getSessionDisplayData: () => getSessionDisplayData,
-  loadFloPay: () => loadFloPay
-});
-module.exports = __toCommonJS(index_exports);
-
-// src/load.ts
-var import_shared7 = require("@flopay/shared");
-
-// src/stripe-adapter.ts
-var import_stripe_js = require("@stripe/stripe-js");
-var import_shared3 = require("@flopay/shared");
-
-// src/payment-api.ts
-var import_shared2 = require("@flopay/shared");
-
-// src/api-error.ts
-function readErrorString(value) {
-  return typeof value === "string" && value.trim() ? value : void 0;
-}
-function readErrorMessage(value) {
-  if (typeof value === "string") return value.trim() ? value : void 0;
-  if (Array.isArray(value)) {
-    const joined = value.filter((entry) => typeof entry === "string" && entry.trim().length > 0).join("; ");
-    return joined || void 0;
-  }
-  return void 0;
-}
-
-// src/session-display-cache.ts
-var STORAGE_KEY_PREFIX = "flopay_session_display:";
-var DEFAULT_TTL_MS = 60 * 60 * 1e3;
-var memoryStore = /* @__PURE__ */ new Map();
-function storageKey(sessionId) {
-  return `${STORAGE_KEY_PREFIX}${sessionId}`;
-}
-function getSessionStorage() {
-  if (typeof window === "undefined") return null;
-  try {
-    return window.sessionStorage;
-  } catch {
-    return null;
-  }
-}
-function cacheSessionDisplayData(sessionId, data, options) {
-  if (!sessionId) return;
-  const ttl = options?.ttlMs ?? DEFAULT_TTL_MS;
-  const entry = { data, expiresAt: Date.now() + ttl };
-  const storage = getSessionStorage();
-  if (storage) {
-    try {
-      storage.setItem(storageKey(sessionId), JSON.stringify(entry));
-      return;
-    } catch {
-    }
-  }
-  memoryStore.set(sessionId, entry);
-}
-function getSessionDisplayData(sessionId) {
-  if (!sessionId) return null;
-  const storage = getSessionStorage();
-  if (storage) {
-    try {
-      const raw = storage.getItem(storageKey(sessionId));
-      if (raw) {
-        const entry = JSON.parse(raw);
-        if (entry && typeof entry.expiresAt === "number" && entry.expiresAt > Date.now()) {
-          return entry.data;
-        }
-        storage.removeItem(storageKey(sessionId));
-      }
-    } catch {
-    }
-  }
-  const memEntry = memoryStore.get(sessionId);
-  if (memEntry) {
-    if (memEntry.expiresAt > Date.now()) {
-      return memEntry.data;
-    }
-    memoryStore.delete(sessionId);
-  }
-  return null;
-}
-function clearSessionDisplayData(sessionId) {
-  if (!sessionId) return;
-  memoryStore.delete(sessionId);
-  const storage = getSessionStorage();
-  if (storage) {
-    try {
-      storage.removeItem(storageKey(sessionId));
-    } catch {
-    }
-  }
-}
-
-// src/telemetry-reporter.ts
-var import_shared = require("@flopay/shared");
-var TELEMETRY_PATH = "/v1/sdk-telemetry/events";
-var MAX_BATCH_SIZE = 16;
-var MAX_QUEUE_SIZE = 64;
-var UPLOAD_TIMEOUT_MS = 1500;
-var ERROR_DEDUPLICATION_WINDOW_MS = 1e3;
-var MAX_REPORTED_FAILURES = 64;
-var DEDUPLICATION_EVENT_ID = "00000000-0000-4000-8000-000000000000";
-var EVENT_BUDGETS = {
-  technical_error: 8,
-  lifecycle: 32,
-  expected_outcome: 32,
-  performance: 24
-};
-function createUuidV4() {
-  try {
-    return globalThis.crypto.randomUUID();
-  } catch {
-    const bytes = new Uint8Array(16);
-    try {
-      globalThis.crypto.getRandomValues(bytes);
-    } catch {
-      for (let index = 0; index < bytes.length; index += 1) {
-        bytes[index] = Math.floor(Math.random() * 256);
-      }
-    }
-    bytes[6] = bytes[6] & 15 | 64;
-    bytes[8] = bytes[8] & 63 | 128;
-    const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
-    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
-  }
-}
-function bodyByteLength(body) {
-  try {
-    return new TextEncoder().encode(body).byteLength;
-  } catch {
-    return body.length;
-  }
-}
-function failureDeduplicationKey(event) {
-  return JSON.stringify([
-    event.code,
-    event.stage,
-    event.provider,
-    event.attempt,
-    event.statusClass,
-    event.requestCategory,
-    event.paymentMethodCategory,
-    event.checkoutMode,
-    event.layout
-  ]);
-}
-function telemetryNow() {
-  return globalThis.performance?.now() ?? 0;
-}
-var TelemetryReporter = class {
-  constructor(options) {
-    this.ingestionDisabled = false;
-    this.queue = [];
-    this.sequence = 0;
-    this.flushTimer = null;
-    this.flushInFlight = null;
-    this.reportedFailures = /* @__PURE__ */ new Map();
-    this.checkoutContext = {};
-    this.checkoutStartedAt = null;
-    this.destroyed = false;
-    this.pageExitHandler = () => {
-      this.drainQueue();
-    };
-    this.visibilityHandler = () => {
-      if (document.visibilityState === "hidden") void this.flush();
-    };
-    this.eventCounts = {
-      technical_error: 0,
-      lifecycle: 0,
-      expected_outcome: 0,
-      performance: 0
-    };
-    this.endpoint = `${options.billingApiUrl.replace(/\/+$/, "")}${TELEMETRY_PATH}`;
-    this.sdkPackage = options.sdkPackage ?? "@flopay/js";
-    this.sdkVersion = options.sdkVersion;
-    this.correlationId = createUuidV4();
-    this.merchantEnabled = options.enabled !== false;
-    this.clock = options.clock ?? telemetryNow;
-    this.browserTransportAvailable = typeof window !== "undefined" && typeof document !== "undefined";
-    if (this.browserTransportAvailable) {
-      window.addEventListener("pagehide", this.pageExitHandler);
-      document.addEventListener("visibilitychange", this.visibilityHandler);
-    }
-  }
-  log(input) {
-    if (!this.canCollect()) return;
-    this.enqueue((0, import_shared.buildTelemetryLogEvent)({
-      ...this.checkoutContext,
-      ...input,
-      eventId: createUuidV4(),
-      sequence: this.sequence++
-    }));
-  }
-  error(input) {
-    if (!this.canCollect()) return;
-    const normalizedFailure = (0, import_shared.buildTelemetryErrorEvent)({
-      ...this.checkoutContext,
-      ...input,
-      eventId: DEDUPLICATION_EVENT_ID,
-      sequence: 0
-    });
-    const deduplicationKey = failureDeduplicationKey(normalizedFailure);
-    const now = this.now();
-    this.pruneReportedFailures(now);
-    const previouslyReportedAt = this.reportedFailures.get(deduplicationKey);
-    if (previouslyReportedAt !== void 0 && now >= previouslyReportedAt && now - previouslyReportedAt < ERROR_DEDUPLICATION_WINDOW_MS) {
-      this.log({
-        name: "operation.deduplicated",
-        stage: input.stage,
-        provider: input.provider,
-        paymentMethodCategory: input.paymentMethodCategory,
-        attempt: input.attempt
-      });
-      return;
-    }
-    this.rememberReportedFailure(deduplicationKey, now);
-    this.enqueue((0, import_shared.buildTelemetryErrorEvent)({
-      ...this.checkoutContext,
-      ...input,
-      eventId: createUuidV4(),
-      sequence: this.sequence++
-    }));
-  }
-  performance(input) {
-    if (!this.canCollect()) return;
-    this.enqueue((0, import_shared.buildTelemetryPerformanceEvent)({
-      ...this.checkoutContext,
-      ...input,
-      eventId: createUuidV4(),
-      sequence: this.sequence++
-    }));
-  }
-  terminal(input) {
-    if (!this.canCollect()) return;
-    this.enqueue((0, import_shared.buildTelemetryTerminalEvent)({
-      ...this.checkoutContext,
-      ...input,
-      eventId: createUuidV4(),
-      sequence: this.sequence++
-    }));
-    if (input.outcome !== "action_required" && this.checkoutStartedAt !== null) {
-      const checkoutStartedAt = this.checkoutStartedAt;
-      this.checkoutStartedAt = null;
-      this.performance({
-        stage: "total_journey",
-        durationMs: Math.max(0, this.now() - checkoutStartedAt),
-        durationMode: "total",
-        provider: input.provider,
-        paymentMethodCategory: input.paymentMethodCategory
-      });
-    }
-  }
-  /** @internal Read the reporter's monotonic clock without Resource Timing. */
-  now() {
-    try {
-      return this.clock();
-    } catch {
-      return telemetryNow();
-    }
-  }
-  pruneReportedFailures(now) {
-    for (const [key, reportedAt] of this.reportedFailures) {
-      if (now < reportedAt || now - reportedAt >= ERROR_DEDUPLICATION_WINDOW_MS) {
-        this.reportedFailures.delete(key);
-      }
-    }
-  }
-  rememberReportedFailure(key, reportedAt) {
-    while (this.reportedFailures.size >= MAX_REPORTED_FAILURES) {
-      const oldest = this.reportedFailures.keys().next();
-      if (oldest.done) break;
-      this.reportedFailures.delete(oldest.value);
-    }
-    this.reportedFailures.set(key, reportedAt);
-  }
-  /** @internal Add closed checkout dimensions to subsequent SDK events. */
-  setCheckoutContext(context) {
-    this.checkoutContext = {
-      checkoutMode: context.checkoutMode,
-      layout: context.layout
-    };
-  }
-  /** @internal Start a fresh checkout budget, dedupe window, and total span. */
-  beginCheckout(context = {}) {
-    if (!this.canCollect()) return 0;
-    this.drainQueue();
-    this.setCheckoutContext(context);
-    this.sequence = 0;
-    this.reportedFailures.clear();
-    this.eventCounts = {
-      technical_error: 0,
-      lifecycle: 0,
-      expected_outcome: 0,
-      performance: 0
-    };
-    this.checkoutStartedAt = this.now();
-    return this.checkoutStartedAt;
-  }
-  enqueue(event) {
-    if (!this.canCollect()) return;
-    if (this.queue.length >= MAX_QUEUE_SIZE || this.eventCounts[event.class] >= EVENT_BUDGETS[event.class]) return;
-    this.eventCounts[event.class] += 1;
-    this.queue.push(event);
-    if (this.queue.length >= MAX_BATCH_SIZE) {
-      void this.flush();
-      return;
-    }
-    this.scheduleFlush();
-  }
-  canCollect() {
-    return this.browserTransportAvailable && this.merchantEnabled && !this.ingestionDisabled && !this.destroyed;
-  }
-  /** Flush one bounded batch. Failures are intentionally dropped. */
-  async flush() {
-    if (this.flushInFlight) return this.flushInFlight;
-    if (!this.browserTransportAvailable || this.destroyed || this.ingestionDisabled || this.queue.length === 0) return;
-    this.clearFlushTimer();
-    const events = this.queue.splice(0, MAX_BATCH_SIZE);
-    this.flushInFlight = this.sendBatch(events).finally(() => {
-      this.flushInFlight = null;
-      if (this.queue.length > 0) this.scheduleFlush();
-    });
-    return this.flushInFlight;
-  }
-  /** Flush pending work and detach browser lifecycle listeners. */
-  destroy() {
-    if (this.destroyed) return;
-    this.drainQueue();
-    this.destroyed = true;
-    this.clearFlushTimer();
-    if (this.browserTransportAvailable) {
-      window.removeEventListener("pagehide", this.pageExitHandler);
-      document.removeEventListener("visibilitychange", this.visibilityHandler);
-    }
-    this.queue.splice(0);
-    this.reportedFailures.clear();
-  }
-  /** Permanently honor a merchant opt-out and discard queued events. */
-  disable() {
-    this.merchantEnabled = false;
-    this.queue.splice(0);
-    this.reportedFailures.clear();
-    this.clearFlushTimer();
-  }
-  /** Start every bounded keepalive request synchronously before page teardown. */
-  drainQueue() {
-    if (!this.browserTransportAvailable || this.destroyed || this.ingestionDisabled || this.queue.length === 0) return;
-    this.clearFlushTimer();
-    while (this.queue.length > 0) {
-      const events = this.queue.splice(0, MAX_BATCH_SIZE);
-      void this.sendBatch(events);
-    }
-  }
-  async sendBatch(events) {
-    if (!this.browserTransportAvailable || this.ingestionDisabled) return;
-    const body = (0, import_shared.serializeTelemetryBatch)(events, {
-      correlationId: this.correlationId,
-      sdkPackage: this.sdkPackage,
-      sdkVersion: this.sdkVersion,
-      batchId: createUuidV4()
-    });
-    if (bodyByteLength(body) > import_shared.TELEMETRY_MAX_BATCH_BYTES) return;
-    const controller = typeof AbortController === "undefined" ? null : new AbortController();
-    let timeout = null;
-    try {
-      const request = fetch(this.endpoint, {
-        method: "POST",
-        headers: { "content-type": "text/plain;charset=UTF-8" },
-        body,
-        credentials: "omit",
-        keepalive: true,
-        referrerPolicy: "no-referrer",
-        signal: controller?.signal
-      }).then(async (response) => {
-        if (response.status !== 202) return null;
-        const payload = await response.json().catch(() => null);
-        return payload?.status === "disabled" ? "disabled" : null;
-      }).catch(() => null);
-      const expired = new Promise((resolve) => {
-        timeout = setTimeout(() => {
-          controller?.abort();
-          resolve(null);
-        }, UPLOAD_TIMEOUT_MS);
-      });
-      const status = await Promise.race([request, expired]);
-      if (status === "disabled") this.disableFromIngestion();
-    } catch {
-    } finally {
-      if (timeout) clearTimeout(timeout);
-    }
-  }
-  disableFromIngestion() {
-    this.ingestionDisabled = true;
-    this.queue.splice(0);
-    this.reportedFailures.clear();
-    this.clearFlushTimer();
-  }
-  scheduleFlush() {
-    if (this.flushTimer || this.destroyed || this.ingestionDisabled) return;
-    this.flushTimer = setTimeout(() => {
-      this.flushTimer = null;
-      void this.flush();
-    }, 0);
-  }
-  clearFlushTimer() {
-    if (!this.flushTimer) return;
-    clearTimeout(this.flushTimer);
-    this.flushTimer = null;
-  }
-};
-var TELEMETRY_REPORTER_FACTORY = /* @__PURE__ */ Symbol.for("@flopay/js.telemetry.reporter-factory.v1");
-var telemetryGlobal = globalThis;
-if (telemetryGlobal[TELEMETRY_REPORTER_FACTORY] === void 0) {
-  Object.defineProperty(telemetryGlobal, TELEMETRY_REPORTER_FACTORY, {
-    configurable: true,
-    enumerable: false,
-    writable: false,
-    value: (options) => new TelemetryReporter(options)
-  });
-}
-
-// src/payment-api.ts
-var DEFAULT_PROCESSING_RETRY_AFTER_MS = 1e3;
-var MIN_PROCESSING_RETRY_AFTER_MS = 500;
-var DEFAULT_PROCESSING_TIMEOUT_MS = 15e3;
-var MAX_PROCESSING_RETRY_AFTER_MS = 3e3;
-var DEFAULT_ACCOUNT_SNAPSHOT_TIMEOUT_MS = 1e4;
-function isRecord(value) {
-  return typeof value === "object" && value !== null;
-}
-function telemetryStatusClass(status) {
-  if (status === void 0) return "network_error";
-  const statusClass = `${Math.floor(status / 100)}xx`;
-  return statusClass === "2xx" || statusClass === "3xx" || statusClass === "4xx" || statusClass === "5xx" ? statusClass : "unknown";
-}
-function telemetryFailure(error, fallbackCode) {
-  if (error instanceof Error && (error.name === "AbortError" || error instanceof import_shared2.FloPayError && error.code === "checkout_processing_timeout")) {
-    return { errorCode: "REQUEST_TIMEOUT", statusClass: "timeout" };
-  }
-  if (error instanceof TypeError) {
-    return { errorCode: "NETWORK_REQUEST_FAILED", statusClass: "network_error" };
-  }
-  return {
-    errorCode: fallbackCode,
-    statusClass: telemetryStatusClass(
-      error instanceof import_shared2.FloPayError ? error.statusCode : void 0
-    )
-  };
-}
-function readString(payload, key) {
-  return readErrorString(payload?.[key]);
-}
-function readMessage(payload, key) {
-  return readErrorMessage(payload?.[key]);
-}
-function readNumber(payload, key) {
-  const value = payload?.[key];
-  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
-function delay(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function createCheckoutProcessingTimeoutError() {
-  return new import_shared2.FloPayError(
-    "Checkout is still processing. Please try again shortly.",
-    "api_error",
-    { code: "checkout_processing_timeout" }
-  );
-}
-async function buildApiErrorFromResponse(response, fallbackMessage) {
-  const payload = await response.json().catch(() => null);
-  const nestedError = isRecord(payload?.error) ? payload.error : null;
-  const message = readMessage(payload, "message") ?? readMessage(nestedError, "message") ?? fallbackMessage;
-  const code = readString(payload, "code") ?? readString(payload, "gatewayErrorCode") ?? readString(nestedError, "code") ?? `http_${response.status}`;
-  return new import_shared2.FloPayError(message, "api_error", {
-    code,
-    statusCode: response.status
-  });
-}
-var NETWORK_RETRY_ATTEMPTS = 2;
-var IDEMPOTENCY_IN_PROGRESS_RETRY_ATTEMPTS = 2;
-async function fetchWithNetworkRetry(input, init, attempts = NETWORK_RETRY_ATTEMPTS, onRetry) {
-  let lastErr;
-  for (let attempt = 0; ; attempt++) {
-    try {
-      return await fetch(input, init);
-    } catch (err) {
-      if (err instanceof Error && err.name === "AbortError") throw err;
-      lastErr = err;
-      if (attempt >= attempts) throw lastErr;
-      try {
-        onRetry?.(attempt + 1);
-      } catch {
-      }
-      await delay(150 * 2 ** attempt);
-    }
-  }
-}
-function isPaymentApiTelemetryHooks(value) {
-  return "now" in value || "onFirstByte" in value || "onSessionCreateFailure" in value || "onRetry" in value;
-}
-var PaymentAPI = class {
-  constructor(billingApiUrl, telemetryOptionsOrHooks = {}) {
-    this.baseUrl = billingApiUrl.replace(/\/+$/, "");
-    const hasInternalHooks = isPaymentApiTelemetryHooks(telemetryOptionsOrHooks);
-    this.telemetryHooks = hasInternalHooks ? telemetryOptionsOrHooks : void 0;
-    this.directTelemetry = hasInternalHooks || telemetryOptionsOrHooks.telemetry === false ? void 0 : new TelemetryReporter({
-      billingApiUrl: this.baseUrl,
-      sdkVersion: import_shared2.SDK_VERSION
-    });
-  }
-  /** Dispose the reporter owned by direct public usage. Internal hooks are never disposed here. */
-  destroy() {
-    this.directTelemetry?.destroy();
-  }
-  reportDirectFailure(error, fallbackCode, stage, requestCategory, paymentMethodCategory = "unknown") {
-    const failure = telemetryFailure(error, fallbackCode);
-    this.directTelemetry?.error({
-      ...failure,
-      stage,
-      requestCategory,
-      paymentMethodCategory
-    });
-  }
-  telemetryTimestamp() {
-    try {
-      return this.telemetryHooks?.now?.() ?? this.directTelemetry?.now() ?? telemetryNow();
-    } catch {
-      return telemetryNow();
-    }
-  }
-  beginDirectTelemetryCheckout(checkoutSessionId) {
-    if (!this.directTelemetry || this.directTelemetryCheckoutId === checkoutSessionId) return;
-    this.directTelemetryCheckoutId = checkoutSessionId;
-    this.directTelemetry.beginCheckout();
-  }
-  beginDirectTelemetryOperation() {
-    if (!this.directTelemetry) return;
-    this.directTelemetryCheckoutId = void 0;
-    this.directTelemetry.beginCheckout();
-  }
-  adoptDirectTelemetryCheckout(checkoutSessionId) {
-    if (checkoutSessionId) this.directTelemetryCheckoutId = checkoutSessionId;
-  }
-  /**
-   * Fetch a raw checkout session by ID.
-   *
-   * `nonce` is the session-bound checkout token returned when the session
-   * was created. When supplied it is sent as the `x-checkout-session-token`
-   * header that post-#640 backends match against `checkout_session.nonce`
-   * before returning the row — the UUID alone is no longer sufficient.
-   * Backends that don't yet enforce it ignore the extra header.
-   */
-  async getCheckoutSession(checkoutSessionId, nonce) {
-    this.beginDirectTelemetryCheckout(checkoutSessionId);
-    const requestStarted = this.telemetryTimestamp();
-    this.directTelemetry?.log({
-      name: "session.read.started",
-      stage: "session_read",
-      requestCategory: "session_read"
-    });
-    const headers = { [import_shared2.FLO_SDK_VERSION_HEADER]: import_shared2.SDK_VERSION };
-    if (nonce) headers["x-checkout-session-token"] = nonce;
-    try {
-      const response = await fetchWithNetworkRetry(
-        `${this.baseUrl}/v1/checkouts/sessions/${encodeURIComponent(checkoutSessionId)}`,
-        { headers },
-        NETWORK_RETRY_ATTEMPTS,
-        (attempt) => {
-          this.telemetryHooks?.onRetry?.("session_read", attempt);
-          this.directTelemetry?.log({
-            name: "operation.retry",
-            stage: "session_read",
-            requestCategory: "session_read",
-            attempt
-          });
-        }
-      );
-      const firstByteDuration = Math.max(0, this.telemetryTimestamp() - requestStarted);
-      try {
-        this.telemetryHooks?.onFirstByte?.(firstByteDuration);
-      } catch {
-      }
-      const statusClass = `${Math.floor(response.status / 100)}xx`;
-      this.directTelemetry?.log({
-        name: "session.request.first_byte",
-        stage: "session_first_byte",
-        requestCategory: "session_read",
-        statusClass
-      });
-      this.directTelemetry?.performance({
-        stage: "session_first_byte",
-        durationMs: firstByteDuration,
-        durationMode: "machine",
-        requestCategory: "session_read",
-        statusClass
-      });
-      if (!response.ok) {
-        throw await buildApiErrorFromResponse(response, "Failed to get checkout session");
-      }
-      const body = await response.json();
-      this.directTelemetry?.log({
-        name: "session.request.completed",
-        stage: "session_complete",
-        requestCategory: "session_read",
-        statusClass
-      });
-      this.directTelemetry?.performance({
-        stage: "session_complete",
-        durationMs: Math.max(0, this.telemetryTimestamp() - requestStarted),
-        durationMode: "machine",
-        requestCategory: "session_read",
-        statusClass
-      });
-      return { ...body, data: this.mergeCachedDisplayData(body.data) };
-    } catch (error) {
-      const statusCode = error instanceof import_shared2.FloPayError ? error.statusCode : void 0;
-      this.directTelemetry?.error({
-        errorCode: error instanceof import_shared2.FloPayError && error.code === "checkout_processing_timeout" ? "REQUEST_TIMEOUT" : "NETWORK_REQUEST_FAILED",
-        stage: "session_read",
-        requestCategory: "session_read",
-        statusClass: statusCode ? `${Math.floor(statusCode / 100)}xx` : "network_error"
-      });
-      throw error;
-    }
-  }
-  /**
-   * Stash display-only data for a session so subsequent fetches can fill in
-   * fields the backend no longer persists (`overrideAmount`, `totalAmount`,
-   * `providerItemName`, `providerPlanName`).
-   *
-   * Backed by `sessionStorage` in the browser, with an in-memory fallback in
-   * Node/SSR contexts. Default TTL: 1 hour.
-   *
-   * Server-returned values always win — cached values fill in only where the
-   * server returned `null` / `undefined`.
-   *
-   * @example
-   * ```ts
-   * paymentAPI.cacheSessionDisplayData(sessionId, {
-   *   currency: 'USD',
-   *   items: [{ code: 'pro_plan', overrideAmount: 24.99, providerItemName: 'Pro' }],
-   * });
-   * ```
-   */
-  cacheSessionDisplayData(sessionId, data, options) {
-    cacheSessionDisplayData(sessionId, data, options);
-  }
-  /**
-   * Drop any cached display data for a session. Call after the payment
-   * completes; otherwise the TTL handles cleanup.
-   */
-  clearSessionDisplayData(sessionId) {
-    clearSessionDisplayData(sessionId);
-  }
-  /**
-   * Fetch (re-mint) the hosted vault capture widget for a session
-   * (TeamFloPay/backend#823).
-   *
-   * `POST /v1/checkouts/sessions/{id}/vault/capture` returns the SDK-ready
-   * {@link VaultCaptureBlock} (`html` + `url`, plus `messageToken` /
-   * `expectedOrigin` once the backend mints them). The SDK injects `html` as
-   * the card-capture widget. This is the fallback path for sessions that did
-   * not receive the embedded `vault` block on create (e.g. a session loaded by
-   * id via `GET`, or a pre-1.3.0 create); the endpoint is idempotent and reuses
-   * session-cached creds when available.
-   *
-   * Because the endpoint is idempotent, the request is wrapped in
-   * `fetchWithNetworkRetry`: a transient network blip (dropped connection, DNS
-   * hiccup, failed CORS preflight) would otherwise leave the secure card form
-   * unable to load and hard-block checkout.
-   *
-   * The PCIVault submit *secret* the backend may include in the response is
-   * intentionally **not** read or surfaced — it is server-only and never enters
-   * the SDK runtime.
-   *
-   * `nonce` is forwarded as `x-checkout-session-token` (required by post-#640
-   * backends, matched against the session's stored nonce).
-   */
-  async getVaultCapture(checkoutSessionId, nonce) {
-    this.beginDirectTelemetryCheckout(checkoutSessionId);
-    const startedAt = this.telemetryTimestamp();
-    this.directTelemetry?.log({
-      name: "vault.capture.requested",
-      stage: "vault_request",
-      requestCategory: "vault_capture",
-      paymentMethodCategory: "card"
-    });
-    const headers = { "Content-Type": "application/json" };
-    if (nonce) headers["x-checkout-session-token"] = nonce;
-    try {
-      const response = await fetchWithNetworkRetry(
-        `${this.baseUrl}/v1/checkouts/sessions/${encodeURIComponent(checkoutSessionId)}/vault/capture`,
-        { method: "POST", headers },
-        NETWORK_RETRY_ATTEMPTS,
-        (attempt) => {
-          this.telemetryHooks?.onRetry?.("vault_capture", attempt);
-          this.directTelemetry?.log({
-            name: "operation.retry",
-            stage: "vault_request",
-            requestCategory: "vault_capture",
-            paymentMethodCategory: "card",
-            attempt
-          });
-        }
-      );
-      if (!response.ok) {
-        throw await buildApiErrorFromResponse(response, "Failed to load the secure card form");
-      }
-      const block = await response.json();
-      this.directTelemetry?.performance({
-        stage: "vault_request",
-        durationMs: Math.max(0, this.telemetryTimestamp() - startedAt),
-        durationMode: "machine",
-        requestCategory: "vault_capture",
-        paymentMethodCategory: "card",
-        statusClass: "2xx"
-      });
-      return this.toVaultBlock(block);
-    } catch (error) {
-      this.reportDirectFailure(
-        error,
-        "VAULT_LOAD_FAILED",
-        "vault_request",
-        "vault_capture",
-        "card"
-      );
-      throw error;
-    }
-  }
-  /**
-   * Fetch and normalize a checkout session.
-   *
-   * Reads the backend's `gateways` map to enumerate provider-specific data,
-   * then wraps the session in a `NormalizedCheckoutSession` for provider-
-   * agnostic consumption.
-   */
-  async getUnifiedCheckoutSession(checkoutSessionId, nonce) {
-    const res = await this.getCheckoutSession(checkoutSessionId, nonce);
-    const normalized = this.normalizeRawSession(res.data);
-    const vault = res.vault;
-    if (vault && normalized.data.session) {
-      normalized.data.session.vault = this.toVaultBlock(vault);
-    }
-    return normalized;
-  }
-  /**
-   * Submit a tokenized payment to the billing backend.
-   *
-   * The backend will either succeed, return `type: '3ds_required'`
-   * (with a `threeDSecureToken`), or return `type: 'paypal_redirect_required'`.
-   *
-   * Hits the session-scoped route `POST /v1/checkouts/sessions/:id/process`
-   * and forwards `data.nonce` as `x-checkout-session-token`. Backend
-   * `TeamFloPay/backend#640` rejects callers without a matching nonce with a
-   * 401 — this method throws synchronously when `data.nonce` is missing so the
-   * problem surfaces before the network round trip.
-   *
-   * @param userId Vestigial — backend's GatewayInterceptor routes via session,
-   *   not headers, so this value is no longer sent on the wire. Kept in the
-   *   signature for back-compat with existing callers; will be removed in a
-   *   future major version.
-   */
-  async processPayment(_userId, data, options) {
-    this.beginDirectTelemetryCheckout(data.sessionId);
-    if (!data.nonce) {
-      this.directTelemetry?.terminal({
-        outcome: "validation_rejected",
-        stage: "processing",
-        requestCategory: "process_payment"
-      });
-      throw new import_shared2.FloPayError(
-        "processPayment requires `nonce` \u2014 pass the value returned from session creation.",
-        "validation_error",
-        { code: "MissingCheckoutSessionToken", param: "nonce" }
-      );
-    }
-    const startedAt = this.telemetryTimestamp();
-    this.directTelemetry?.log({
-      name: "payment.processing.started",
-      stage: "processing",
-      requestCategory: "process_payment"
-    });
-    const { nonce, ...processBody } = data;
-    let response;
-    try {
-      response = await fetch(
-        `${this.baseUrl}/v1/checkouts/sessions/${encodeURIComponent(data.sessionId)}/process`,
-        {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            "x-checkout-session-token": nonce
-          },
-          body: JSON.stringify(processBody)
-        }
-      );
-    } catch (error) {
-      this.reportDirectFailure(
-        error,
-        "PAYMENT_PROCESSING_FAILED",
-        "processing",
-        "process_payment"
-      );
-      throw error;
-    }
-    if (!response.ok && response.status !== 202) {
-      this.directTelemetry?.error({
-        errorCode: "PAYMENT_PROCESSING_FAILED",
-        stage: "processing",
-        requestCategory: "process_payment",
-        statusClass: telemetryStatusClass(response.status)
-      });
-      return response;
-    }
-    try {
-      const result = await this.resolveProcessResponse(
-        response,
-        data.sessionId,
-        { ...options, nonce }
-      );
-      this.directTelemetry?.log({
-        name: "payment.processing.completed",
-        stage: "processing",
-        requestCategory: "process_payment",
-        statusClass: telemetryStatusClass(result.status)
-      });
-      this.directTelemetry?.performance({
-        stage: "processing",
-        durationMs: Math.max(0, this.telemetryTimestamp() - startedAt),
-        durationMode: "machine",
-        requestCategory: "process_payment",
-        statusClass: telemetryStatusClass(result.status)
-      });
-      return result;
-    } catch (error) {
-      if (!(error instanceof import_shared2.FloPayError && error.code === "checkout_processing_timeout")) {
-        this.reportDirectFailure(
-          error,
-          "PAYMENT_PROCESSING_FAILED",
-          "processing",
-          "process_payment"
-        );
-      }
-      throw error;
-    }
-  }
-  /**
-   * Patch the buyer's account snapshot (email, name, billing address, AVS
-   * intent) onto a checkout session via
-   * `PATCH /v1/checkouts/sessions/{id}/account` (TeamFloPay/backend#823).
-   *
-   * The vault path's hosted form owns the charge end-to-end so the SDK
-   * never calls `/process` on this path; the buyer-typed AVS / billing
-   * address would otherwise be lost. The SDK calls this just before
-   * submitting the vault widget so the downstream listener mints the
-   * Stripe PaymentMethod with the right `billing_details.address` and the
-   * per-attempt + per-PM address snapshots are populated.
-   *
-   * Body shape mirrors the relevant subset of `/process`'s
-   * `ProcessCheckoutBodyDto` — same keys, same validators. The endpoint
-   * is idempotent: empty/undefined fields are not written, addresses are
-   * last-writer-wins, AVS analytics are first-writer-wins.
-   *
-   * Wrapped in `fetchWithNetworkRetry` because a transient blip on this
-   * pre-pay PATCH would silently leave AVS unsent and cause an
-   * AVS-protected charge to decline downstream.
-   */
-  async patchAccountSnapshot(sessionId, nonce, body, options) {
-    this.beginDirectTelemetryCheckout(sessionId);
-    const startedAt = this.telemetryTimestamp();
-    this.directTelemetry?.log({
-      name: "operation.state_transition",
-      stage: "processing",
-      requestCategory: "account_snapshot"
-    });
-    const timeoutMs = options?.timeoutMs ?? DEFAULT_ACCOUNT_SNAPSHOT_TIMEOUT_MS;
-    const controller = new AbortController();
-    const onCallerAbort = () => controller.abort();
-    if (options?.signal) {
-      if (options.signal.aborted) controller.abort();
-      else options.signal.addEventListener("abort", onCallerAbort, { once: true });
-    }
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
-    try {
-      let response;
-      try {
-        response = await fetchWithNetworkRetry(
-          `${this.baseUrl}/v1/checkouts/sessions/${encodeURIComponent(sessionId)}/account`,
-          {
-            method: "PATCH",
-            headers: {
-              "Content-Type": "application/json",
-              "x-checkout-session-token": nonce
-            },
-            body: JSON.stringify(body),
-            signal: controller.signal
-          },
-          NETWORK_RETRY_ATTEMPTS,
-          (attempt) => {
-            this.telemetryHooks?.onRetry?.("account_snapshot", attempt);
-            this.directTelemetry?.log({
-              name: "operation.retry",
-              stage: "processing",
-              requestCategory: "account_snapshot",
-              attempt
-            });
-          }
-        );
-      } finally {
-        clearTimeout(timer);
-        options?.signal?.removeEventListener("abort", onCallerAbort);
-      }
-      if (!response.ok) {
-        throw await buildApiErrorFromResponse(response, "Failed to persist account snapshot");
-      }
-      this.directTelemetry?.performance({
-        stage: "processing",
-        durationMs: Math.max(0, this.telemetryTimestamp() - startedAt),
-        durationMode: "machine",
-        requestCategory: "account_snapshot",
-        statusClass: "2xx"
-      });
-    } catch (error) {
-      this.reportDirectFailure(
-        error,
-        "NETWORK_REQUEST_FAILED",
-        "processing",
-        "account_snapshot"
-      );
-      throw error;
-    }
-  }
-  /** Create a wallet/APM/PayPal intent through the session-scoped contract. */
-  async createSessionIntent(sessionId, nonce, request, options) {
-    if (!nonce) {
-      throw new import_shared2.FloPayError(
-        "createSessionIntent requires the checkout session nonce.",
-        "validation_error",
-        { code: "MissingCheckoutSessionToken", param: "nonce" }
-      );
-    }
-    const rawRequest = request;
-    const paymentMethodType = rawRequest["paymentMethodType"];
-    const directCardType = typeof paymentMethodType === "string" && paymentMethodType.trim().toLowerCase() === "card";
-    const commonRequestFieldsValid = typeof paymentMethodType === "string" && paymentMethodType.length > 0 && !directCardType && (typeof rawRequest["paymentMethodId"] === "string" || rawRequest["paymentMethodId"] === null);
-    const stripeRequestValid = rawRequest["provider"] === "stripe" && (rawRequest["paymentMethodCategory"] === "wallet" || rawRequest["paymentMethodCategory"] === "apm") && (rawRequest["intentKind"] === "payment" || rawRequest["intentKind"] === "setup");
-    const paypalRequestValid = rawRequest["provider"] === "paypal" && rawRequest["paymentMethodCategory"] === "wallet" && rawRequest["paymentMethodType"] === "paypal" && rawRequest["paymentMethodId"] === null && rawRequest["intentKind"] === "payment";
-    if (!commonRequestFieldsValid || !stripeRequestValid && !paypalRequestValid) {
-      throw new import_shared2.FloPayError(
-        "Only wallet, APM, and PayPal session intents are supported.",
-        "validation_error",
-        { code: "InvalidSessionIntentRequest" }
-      );
-    }
-    const suppliedAttemptId = rawRequest["authorizationAttemptId"];
-    if (suppliedAttemptId !== void 0 && !(0, import_shared2.isUuidV4)(suppliedAttemptId)) {
-      throw new import_shared2.FloPayError(
-        "authorizationAttemptId must be a v4 UUID identifying one buyer authorization attempt.",
-        "validation_error",
-        { code: "InvalidAuthorizationAttemptId", param: "authorizationAttemptId" }
-      );
-    }
-    const authorizationAttemptId = (0, import_shared2.isUuidV4)(suppliedAttemptId) ? suppliedAttemptId : (0, import_shared2.randomUuidV4)();
-    this.beginDirectTelemetryCheckout(sessionId);
-    const startedAt = this.telemetryTimestamp();
-    this.directTelemetry?.log({
-      name: "payment.intent.started",
-      stage: "processing",
-      requestCategory: "intent_create"
-    });
-    const headers = {
-      "Content-Type": "application/json",
-      "x-checkout-session-token": nonce,
-      [import_shared2.IDEMPOTENCY_KEY_HEADER]: options?.idempotencyKey || authorizationAttemptId
-    };
-    let failureReported = false;
-    try {
-      const response = await fetch(
-        `${this.baseUrl}/v1/checkouts/sessions/${encodeURIComponent(sessionId)}/intents`,
-        {
-          method: "POST",
-          headers,
-          body: JSON.stringify({ ...request, authorizationAttemptId }),
-          signal: options?.signal
-        }
-      );
-      if (!response.ok) {
-        failureReported = true;
-        this.directTelemetry?.error({
-          errorCode: "PAYMENT_PROCESSING_FAILED",
-          stage: "processing",
-          requestCategory: "intent_create",
-          statusClass: telemetryStatusClass(response.status)
-        });
-        throw await buildApiErrorFromResponse(response, "Failed to create checkout intent");
-      }
-      const body = await response.json();
-      const data = body.data;
-      if (!data || typeof data !== "object") {
-        throw new import_shared2.FloPayError("Invalid checkout intent response.", "api_error", {
-          code: "InvalidSessionIntentResponse"
-        });
-      }
-      const intent = data;
-      const responsePaymentMethodType = intent["paymentMethodType"];
-      const commonFieldsValid = (intent["paymentMethodCategory"] === "wallet" || intent["paymentMethodCategory"] === "apm") && typeof responsePaymentMethodType === "string" && responsePaymentMethodType.trim().toLowerCase() !== "card" && (typeof intent["paymentMethodId"] === "string" || intent["paymentMethodId"] === null) && typeof intent["providerObjectId"] === "string";
-      const stripeValid = intent["provider"] === "stripe" && (intent["intentKind"] === "payment" || intent["intentKind"] === "setup") && typeof intent["clientSecret"] === "string";
-      const paypalValid = intent["provider"] === "paypal" && intent["paymentMethodCategory"] === "wallet" && intent["paymentMethodType"] === "paypal" && intent["paymentMethodId"] === null && intent["intentKind"] === "payment" && (intent["providerObjectType"] === "order" || intent["providerObjectType"] === "subscription") && intent["clientSecret"] === null;
-      const discriminantsMatchRequest = intent["provider"] === request.provider && intent["paymentMethodCategory"] === request.paymentMethodCategory && intent["paymentMethodType"] === request.paymentMethodType && intent["paymentMethodId"] === request.paymentMethodId && intent["intentKind"] === request.intentKind;
-      if (!commonFieldsValid || !stripeValid && !paypalValid || !discriminantsMatchRequest) {
-        throw new import_shared2.FloPayError("Invalid checkout intent response.", "api_error", {
-          code: "InvalidSessionIntentResponse"
-        });
-      }
-      this.directTelemetry?.log({
-        name: "payment.intent.completed",
-        stage: "processing",
-        requestCategory: "intent_create",
-        statusClass: telemetryStatusClass(response.status)
-      });
-      this.directTelemetry?.performance({
-        stage: "processing",
-        durationMs: Math.max(0, this.telemetryTimestamp() - startedAt),
-        durationMode: "machine",
-        requestCategory: "intent_create",
-        statusClass: telemetryStatusClass(response.status)
-      });
-      return intent;
-    } catch (error) {
-      if (!failureReported) {
-        this.reportDirectFailure(
-          error,
-          "PAYMENT_PROCESSING_FAILED",
-          "processing",
-          "intent_create"
-        );
-      }
-      throw error;
-    }
-  }
-  /** Record a provider-neutral non-card decline without sensitive identifiers. */
-  async reportSessionIntentDecline(sessionId, nonce, request, options) {
-    if (!nonce) {
-      throw new import_shared2.FloPayError(
-        "reportSessionIntentDecline requires the checkout session nonce.",
-        "validation_error",
-        { code: "MissingCheckoutSessionToken", param: "nonce" }
-      );
-    }
-    const rawRequest = request;
-    const reason = rawRequest["providerDeclineReason"];
-    const paymentMethodType = rawRequest["paymentMethodType"];
-    const safeReason = typeof reason === "string" && /^[a-z0-9][a-z0-9_.:-]{0,63}$/i.test(reason) && !/^(?:pm|pi|seti|tok|src|cus|sess|sk|pk)_/i.test(reason);
-    const commonFieldsValid = typeof paymentMethodType === "string" && paymentMethodType.length > 0 && paymentMethodType.trim().toLowerCase() !== "card" && safeReason;
-    const stripeFieldsValid = rawRequest["provider"] === "stripe" && (rawRequest["paymentMethodCategory"] === "wallet" || rawRequest["paymentMethodCategory"] === "apm");
-    const paypalFieldsValid = rawRequest["provider"] === "paypal" && rawRequest["paymentMethodCategory"] === "wallet" && rawRequest["paymentMethodType"] === "paypal";
-    if (!commonFieldsValid || !stripeFieldsValid && !paypalFieldsValid) {
-      throw new import_shared2.FloPayError(
-        "Invalid non-card decline classification.",
-        "validation_error",
-        { code: "InvalidSessionIntentDeclineRequest" }
-      );
-    }
-    const safeRequest = paypalFieldsValid ? {
-      provider: "paypal",
-      paymentMethodCategory: "wallet",
-      paymentMethodType: "paypal",
-      providerDeclineReason: reason
-    } : {
-      provider: "stripe",
-      paymentMethodCategory: rawRequest["paymentMethodCategory"],
-      paymentMethodType: rawRequest["paymentMethodType"],
-      providerDeclineReason: reason
-    };
-    const response = await fetch(
-      `${this.baseUrl}/v1/checkouts/sessions/${encodeURIComponent(sessionId)}/intents/decline`,
-      {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "x-checkout-session-token": nonce
-        },
-        body: JSON.stringify(safeRequest),
-        signal: options?.signal
-      }
-    );
-    if (!response.ok) {
-      throw await buildApiErrorFromResponse(response, "Failed to report checkout decline");
-    }
-  }
-  /**
-   * Fetch user's prior payments by email.
-   * Used to determine if saved card UX should be shown.
-   */
-  async getPaymentsByEmail(email, options) {
-    this.beginDirectTelemetryOperation();
-    const startedAt = this.telemetryTimestamp();
-    this.directTelemetry?.log({
-      name: "operation.recovery.started",
-      stage: "recovery",
-      requestCategory: "other",
-      paymentMethodCategory: "saved"
-    });
-    const page = options?.page ?? 1;
-    const limit = options?.limit ?? 1;
-    const params = new URLSearchParams({
-      email,
-      page: String(page),
-      limit: String(limit),
-      sortField: "createdAt",
-      sortDirection: "DESC"
-    });
-    try {
-      const response = await fetch(
-        `${this.baseUrl}/v1/payments?${params.toString()}`,
-        {
-          method: "GET",
-          signal: options?.signal,
-          keepalive: true
-        }
-      );
-      if (!response.ok) {
-        throw new import_shared2.FloPayError(
-          "Failed to fetch payments",
-          "api_error",
-          { statusCode: response.status }
-        );
-      }
-      const result = await response.json();
-      this.directTelemetry?.log({
-        name: "operation.recovery.completed",
-        stage: "recovery",
-        requestCategory: "other",
-        paymentMethodCategory: "saved",
-        statusClass: "2xx"
-      });
-      this.directTelemetry?.performance({
-        stage: "recovery",
-        durationMs: Math.max(0, this.telemetryTimestamp() - startedAt),
-        durationMode: "machine",
-        requestCategory: "other",
-        paymentMethodCategory: "saved",
-        statusClass: "2xx"
-      });
-      return result;
-    } catch (error) {
-      this.reportDirectFailure(error, "RECOVERY_FAILED", "recovery", "other", "saved");
-      throw error;
-    }
-  }
-  /**
-   * Create a checkout session AND return the full session data in one call.
-   * Uses `?expand=true` so the backend returns the complete session
-   * instead of just a UUID — eliminating the need for a second GET.
-   *
-   * Falls back to create + GET if the backend doesn't support `expand`.
-   */
-  async createAndFetchSession(params) {
-    this.beginDirectTelemetryOperation();
-    const startedAt = this.telemetryTimestamp();
-    this.directTelemetry?.log({
-      name: "session.create.started",
-      stage: "session_create",
-      requestCategory: "session_create"
-    });
-    try {
-      const result = await this.createAndFetchSessionRequest(params, startedAt);
-      this.adoptDirectTelemetryCheckout(result.data.session?.id);
-      this.directTelemetry?.log({
-        name: "session.request.completed",
-        stage: "session_complete",
-        requestCategory: "session_create",
-        statusClass: "2xx"
-      });
-      this.directTelemetry?.performance({
-        stage: "session_create",
-        durationMs: this.telemetryTimestamp() - startedAt,
-        durationMode: "machine",
-        requestCategory: "session_create",
-        statusClass: "2xx"
-      });
-      return result;
-    } catch (error) {
-      if (!(error instanceof import_shared2.FloPayError && error.code === "session_auto_completed")) {
-        try {
-          this.telemetryHooks?.onSessionCreateFailure?.(error);
-        } catch {
-        }
-      }
-      if (error instanceof import_shared2.FloPayError && error.type === "validation_error") {
-        this.directTelemetry?.terminal({
-          outcome: "validation_rejected",
-          stage: "session_create",
-          requestCategory: "session_create"
-        });
-      } else if (!(error instanceof import_shared2.FloPayError && error.code === "session_auto_completed")) {
-        const statusCode = error instanceof import_shared2.FloPayError ? error.statusCode : void 0;
-        this.directTelemetry?.error({
-          errorCode: error instanceof Error && error.name === "AbortError" ? "REQUEST_TIMEOUT" : error instanceof TypeError ? "NETWORK_REQUEST_FAILED" : "CHECKOUT_SESSION_CREATE_FAILED",
-          stage: "session_create",
-          requestCategory: "session_create",
-          statusClass: error instanceof Error && error.name === "AbortError" ? "timeout" : statusCode ? `${Math.floor(statusCode / 100)}xx` : "network_error"
-        });
-      }
-      throw error;
-    }
-  }
-  async createAndFetchSessionRequest(params, telemetryStartedAt) {
-    const wireProducts = params.products ?? (0, import_shared2.foldIntoProducts)(params.items, params.subscriptions);
-    const sessionCurrency = (0, import_shared2.resolveSessionCurrency)(
-      params.currency,
-      params.items,
-      params.subscriptions,
-      wireProducts
-    );
-    if (!sessionCurrency) {
-      throw new import_shared2.FloPayError(
-        "currency is required: pass `currency` on the session, or include a `currency` on the first item/subscription/product.",
-        "validation_error",
-        { code: "CurrencyRequired", param: "currency" }
-      );
-    }
-    const payload = {
-      clientId: params.clientId,
-      checkoutVersion: import_shared2.SDK_VERSION,
-      successUrl: params.successUrl,
-      cancelUrl: params.cancelUrl,
-      currency: sessionCurrency,
-      checkoutMode: params.checkoutMode ?? "full",
-      products: wireProducts.map((product) => (0, import_shared2.buildProductPayload)(product, sessionCurrency)),
-      accountData: {
-        userId: params.account.userId,
-        firstName: params.account.firstName ?? null,
-        lastName: params.account.lastName ?? null,
-        email: params.account.email,
-        country: params.account.country ?? null,
-        gender: params.account.gender ?? null,
-        city: params.account.city ?? null,
-        state: params.account.state ?? null,
-        zip: params.account.zip ?? null,
-        addressLine1: params.account.addressLine1 ?? null,
-        addressLine2: params.account.addressLine2 ?? null
-      },
-      couponCodes: params.couponCodes ?? []
-    };
-    if (params.tokenizedData) payload["tokenizedData"] = params.tokenizedData;
-    if (params.tagsData) payload["tagsData"] = params.tagsData;
-    if (params.utmMetadata?.length) payload["utmMetadata"] = params.utmMetadata;
-    if (params.avsCheck !== void 0) payload["avsCheck"] = params.avsCheck;
-    if (params.checkoutType) payload["checkoutType"] = params.checkoutType;
-    if (params.checkoutLayout) payload["checkoutLayout"] = params.checkoutLayout;
-    if (params.avsConfig) payload["avsConfig"] = params.avsConfig;
-    const headers = {
-      "Content-Type": "application/json",
-      // Retain the SDK version header for compatibility visibility. Backends
-      // must not gate the hosted vault block on this value.
-      [import_shared2.FLO_SDK_VERSION_HEADER]: import_shared2.SDK_VERSION
-    };
-    const idempotencyKey = (0, import_shared2.resolveIdempotencyKey)(params.idempotencyKey);
-    if (idempotencyKey) {
-      headers[import_shared2.IDEMPOTENCY_KEY_HEADER] = idempotencyKey;
-    }
-    let response;
-    let firstByteReported = false;
-    for (let attempt = 0; ; attempt++) {
-      response = await fetchWithNetworkRetry(
-        `${this.baseUrl}/v1/checkouts/sessions?expand=true`,
-        {
-          method: "POST",
-          headers,
-          body: JSON.stringify(payload)
-        },
-        NETWORK_RETRY_ATTEMPTS,
-        (networkAttempt) => {
-          this.telemetryHooks?.onRetry?.("session_create", networkAttempt);
-          this.directTelemetry?.log({
-            name: "operation.retry",
-            stage: "session_create",
-            requestCategory: "session_create",
-            attempt: networkAttempt
-          });
-        }
-      );
-      if (!firstByteReported) {
-        firstByteReported = true;
-        const statusClass = `${Math.floor(response.status / 100)}xx`;
-        this.directTelemetry?.log({
-          name: "session.request.first_byte",
-          stage: "session_first_byte",
-          requestCategory: "session_create",
-          statusClass
-        });
-        this.directTelemetry?.performance({
-          stage: "session_first_byte",
-          durationMs: this.telemetryTimestamp() - telemetryStartedAt,
-          durationMode: "machine",
-          requestCategory: "session_create",
-          statusClass
-        });
-      }
-      if (response.status === 204) {
-        throw new import_shared2.FloPayError(
-          "Session auto-completed \u2014 payment method already on file",
-          "api_error",
-          { code: "session_auto_completed" }
-        );
-      }
-      if (response.ok) break;
-      const error = await buildApiErrorFromResponse(response, "Failed to create checkout session");
-      if (error.code === import_shared2.IDEMPOTENCY_IN_PROGRESS_CODE && attempt < IDEMPOTENCY_IN_PROGRESS_RETRY_ATTEMPTS) {
-        try {
-          this.telemetryHooks?.onRetry?.("session_create", attempt + 1);
-          this.directTelemetry?.log({
-            name: "operation.retry",
-            stage: "session_create",
-            requestCategory: "session_create",
-            attempt: attempt + 1
-          });
-        } catch {
-        }
-        await delay(150 * 2 ** attempt);
-        continue;
-      }
-      throw error;
-    }
-    const body = await response.json();
-    if (body.data && "gateways" in body.data) {
-      this.autoCacheDisplayData(body.data.uuid, params);
-      const merged = this.mergeCachedDisplayData(body.data);
-      const normalized = this.normalizeRawSession(merged);
-      if (body.vault && normalized.data.session) {
-        normalized.data.session.vault = this.toVaultBlock(body.vault);
-      }
-      return {
-        ...normalized,
-        autoProcessingError: body.autoProcessingError,
-        autoProcessingAttempted: body.autoProcessingAttempted,
-        autoProcessingPending: body.autoProcessingPending
-      };
-    }
-    const uuid = body.data?.uuid;
-    if (!uuid) {
-      throw new import_shared2.FloPayError("No session ID returned", "api_error");
-    }
-    this.autoCacheDisplayData(uuid, params);
-    this.adoptDirectTelemetryCheckout(uuid);
-    const unifiedSession = await this.getUnifiedCheckoutSession(uuid);
-    return {
-      ...unifiedSession,
-      autoProcessingError: body.autoProcessingError,
-      autoProcessingAttempted: body.autoProcessingAttempted,
-      autoProcessingPending: body.autoProcessingPending
-    };
-  }
-  async waitForCheckoutSessionCompletion(checkoutSessionId, options) {
-    this.beginDirectTelemetryCheckout(checkoutSessionId);
-    const startedAt = this.telemetryTimestamp();
-    this.directTelemetry?.log({
-      name: "operation.recovery.started",
-      stage: "recovery",
-      requestCategory: "session_read",
-      paymentMethodCategory: "saved"
-    });
-    const timeoutMs = options?.timeoutMs ?? DEFAULT_PROCESSING_TIMEOUT_MS;
-    const deadline = Date.now() + timeoutMs;
-    let nextDelayMs = this.clampRetryAfterMs(options?.initialDelayMs ?? DEFAULT_PROCESSING_RETRY_AFTER_MS);
-    let pollAttempt = 0;
-    try {
-      while (true) {
-        const remainingMs = deadline - Date.now();
-        if (remainingMs <= 0) {
-          throw createCheckoutProcessingTimeoutError();
-        }
-        if (nextDelayMs > 0) {
-          try {
-            pollAttempt += 1;
-            this.telemetryHooks?.onRetry?.("session_read", pollAttempt);
-            this.directTelemetry?.log({
-              name: "operation.retry",
-              stage: "recovery",
-              requestCategory: "session_read",
-              paymentMethodCategory: "saved",
-              attempt: pollAttempt
-            });
-          } catch {
-          }
-          await delay(Math.min(nextDelayMs, remainingMs));
-          if (Date.now() >= deadline) {
-            throw createCheckoutProcessingTimeoutError();
-          }
-        }
-        const session = await this.getUnifiedCheckoutSession(checkoutSessionId, options?.nonce);
-        const status = session.data.session?.status;
-        if (status === "complete" || status === "expired") {
-          this.directTelemetry?.log({
-            name: "operation.recovery.completed",
-            stage: "recovery",
-            requestCategory: "session_read",
-            paymentMethodCategory: "saved"
-          });
-          this.directTelemetry?.performance({
-            stage: "recovery",
-            durationMs: Math.max(0, this.telemetryTimestamp() - startedAt),
-            durationMode: "machine",
-            requestCategory: "session_read",
-            paymentMethodCategory: "saved"
-          });
-          return session;
-        }
-        if (Date.now() >= deadline) {
-          throw createCheckoutProcessingTimeoutError();
-        }
-        nextDelayMs = this.clampRetryAfterMs(
-          Math.max(nextDelayMs * 2, MIN_PROCESSING_RETRY_AFTER_MS)
-        );
-      }
-    } catch (error) {
-      if (error instanceof import_shared2.FloPayError && error.code === "checkout_processing_timeout") {
-        this.reportDirectFailure(
-          error,
-          "RECOVERY_FAILED",
-          "recovery",
-          "session_read",
-          "saved"
-        );
-      }
-      throw error;
-    }
-  }
-  /** Normalize a raw session into a provider-agnostic shape. */
-  normalizeRawSession(session) {
-    const gateways = session.gateways ?? {};
-    const providers = [];
-    const data = {
-      session: this.toCheckoutSession(session)
-    };
-    const stripeGateway = gateways.stripe;
-    if (stripeGateway?.publishableKey) {
-      providers.push("stripe");
-      const rawSession = session;
-      const stripeClientSecret = [
-        rawSession["stripeClientSecret"],
-        stripeGateway.stripeClientSecret
-      ].find((value) => typeof value === "string" && value.length > 0);
-      data.stripe = {
-        clientSecret: stripeClientSecret ?? "",
-        publishableKey: stripeGateway.publishableKey ?? void 0,
-        paypalPublishableKey: stripeGateway.paypalPublishableKey ?? void 0,
-        environment: stripeGateway.environment,
-        enabledPaymentMethods: Array.isArray(stripeGateway.enabledPaymentMethods) ? stripeGateway.enabledPaymentMethods.filter((m) => typeof m === "string") : void 0
-      };
-    }
-    const paypalGateway = gateways.paypal;
-    if (paypalGateway?.publishableKey) {
-      providers.push("paypal");
-      data.paypal = {
-        publishableKey: paypalGateway.publishableKey,
-        environment: paypalGateway.environment
-      };
-    }
-    return {
-      providers,
-      mode: "tokenize",
-      data,
-      raw: { data: session }
-    };
-  }
-  /** Convert raw session to the SDK CheckoutSession shape. */
-  toCheckoutSession(raw) {
-    const rawProducts = raw.products ?? [];
-    const hasBackendTotal = typeof raw.totalAmount === "number" && Number.isFinite(raw.totalAmount);
-    const computedTotal = rawProducts.reduce(
-      (sum, p) => sum + (p.overrideAmount ?? p.totalAmount ?? 0),
-      0
-    );
-    const totalAmount = hasBackendTotal ? raw.totalAmount : computedTotal;
-    const amountInCents = Math.round(totalAmount * 100);
-    const currency = raw.currency ?? rawProducts[0]?.currency ?? "USD";
-    const mode = rawProducts.some((p) => p.type === "subscription") ? "subscription" : "payment";
-    return {
-      id: raw.uuid,
-      clientSecret: raw.nonce,
-      mode,
-      status: this.toCheckoutSessionStatus(raw.status),
-      amount: amountInCents,
-      currency,
-      customer: {
-        id: raw.accountData.userId,
-        email: raw.accountData.email,
-        firstName: raw.accountData.firstName,
-        lastName: raw.accountData.lastName,
-        country: raw.accountData.country ?? void 0,
-        city: raw.accountData.city ?? void 0,
-        state: raw.accountData.state ?? void 0,
-        zip: raw.accountData.zip ?? void 0,
-        gender: raw.accountData.gender ?? void 0,
-        line1: raw.accountData.addressLine1 ?? void 0,
-        line2: raw.accountData.addressLine2 ?? void 0
-      },
-      metadata: {},
-      checkoutMode: raw.checkoutMode,
-      providerPaymentMethodId: typeof raw.providerPaymentMethodId === "string" ? raw.providerPaymentMethodId : null,
-      products: rawProducts.map((p) => ({
-        ...p,
-        totalAmount: typeof p.totalAmount === "number" ? p.totalAmount : void 0,
-        overrideAmount: typeof p.overrideAmount === "number" ? p.overrideAmount : null,
-        currency: typeof p.currency === "string" ? p.currency : void 0,
-        metadata: p.metadata ?? null
-      })),
-      successUrl: raw.successUrl,
-      cancelUrl: raw.cancelUrl,
-      coupons: raw.coupons,
-      subtotalAmount: raw.subtotalAmount,
-      discountAmount: raw.discountAmount,
-      totalAmount: raw.totalAmount,
-      createdAt: raw.createdAt,
-      gateways: raw.gateways,
-      accountData: raw.accountData,
-      tagsData: raw.tagsData
-    };
-  }
-  /**
-   * Coerce a raw vault block into a typed {@link VaultCaptureBlock}. The
-   * server-only PCIVault submit `secret` is deliberately dropped so it never
-   * lands on the public session surface (logs / telemetry / client inspection).
-   */
-  toVaultBlock(raw) {
-    return {
-      html: typeof raw.html === "string" ? raw.html : void 0,
-      url: typeof raw.url === "string" ? raw.url : void 0,
-      messageToken: typeof raw.messageToken === "string" ? raw.messageToken : void 0,
-      expectedOrigin: typeof raw.expectedOrigin === "string" ? raw.expectedOrigin : void 0
-    };
-  }
-  toCheckoutSessionStatus(status) {
-    if (status === "completed") {
-      return "complete";
-    }
-    if (status === "expired") {
-      return "expired";
-    }
-    return "open";
-  }
-  async resolveProcessResponse(response, checkoutSessionId, options) {
-    if (response.status !== 202) {
-      return response;
-    }
-    const payload = await response.json().catch(() => null);
-    const pending = this.toCheckoutProcessingPending(payload, response, checkoutSessionId);
-    const session = await this.waitForCheckoutSessionCompletion(pending.sessionId, {
-      initialDelayMs: pending.retryAfterMs,
-      timeoutMs: options?.pollTimeoutMs,
-      nonce: options?.nonce
-    });
-    if (session.data.session?.status === "complete") {
-      return new Response(null, { status: 204, statusText: "No Content" });
-    }
-    if (session.data.session?.status === "expired") {
-      throw new import_shared2.FloPayError(
-        "Checkout session has expired.",
-        "api_error",
-        { code: "checkout_session_expired" }
-      );
-    }
-    throw createCheckoutProcessingTimeoutError();
-  }
-  toCheckoutProcessingPending(payload, response, checkoutSessionId) {
-    const retryAfterHeader = response.headers.get("Retry-After");
-    const headerRetryAfterSeconds = retryAfterHeader === null || retryAfterHeader.trim() === "" ? void 0 : Number(retryAfterHeader);
-    const headerRetryAfterMs = headerRetryAfterSeconds !== void 0 && Number.isFinite(headerRetryAfterSeconds) ? headerRetryAfterSeconds * 1e3 : void 0;
-    return {
-      type: "checkout_processing",
-      sessionId: readString(payload, "sessionId") ?? checkoutSessionId,
-      retryAfterMs: this.clampRetryAfterMs(
-        readNumber(payload, "retryAfterMs") ?? headerRetryAfterMs ?? DEFAULT_PROCESSING_RETRY_AFTER_MS
-      ),
-      statusUrl: readString(payload, "statusUrl"),
-      sessionUrl: readString(payload, "sessionUrl")
-    };
-  }
-  clampRetryAfterMs(retryAfterMs) {
-    return Math.max(0, Math.min(retryAfterMs, MAX_PROCESSING_RETRY_AFTER_MS));
-  }
-  /**
-   * Stash the display-only fields the consumer passed into a create-session
-   * call. Runs after the backend assigns a UUID so a later GET on the same
-   * session (typically after a redirect) can fill in fields the backend no
-   * longer persists — `overrideAmount`, `totalAmount`, `name`, etc.
-   *
-   * No-op when no UUID is available.
-   */
-  autoCacheDisplayData(sessionId, params) {
-    if (!sessionId) return;
-    const products = params.products ?? (0, import_shared2.foldIntoProducts)(params.items, params.subscriptions);
-    if (products.length === 0 && !params.currency) {
-      return;
-    }
-    const usingUnifiedProducts = params.products !== void 0;
-    const sessionCurrency = (0, import_shared2.resolveSessionCurrency)(
-      params.currency,
-      usingUnifiedProducts ? void 0 : params.items,
-      usingUnifiedProducts ? void 0 : params.subscriptions,
-      products
-    );
-    cacheSessionDisplayData(sessionId, {
-      currency: sessionCurrency ?? void 0,
-      products: products.map((p) => ({
-        code: p.code ?? p.providerItemId ?? p.providerPlanId,
-        type: p.type,
-        name: p.name ?? p.itemName ?? p.providerItemName ?? p.subscriptionName ?? p.providerPlanName ?? null,
-        totalAmount: p.totalAmount,
-        overrideAmount: p.overrideAmount,
-        currency: p.currency ?? sessionCurrency ?? void 0
-      }))
-    });
-  }
-  /**
-   * Merge cached display-only fields (set by {@link cacheSessionDisplayData})
-   * into a raw session response. Server values always win — cache fills in
-   * only where the server returned `null` / `undefined`.
-   */
-  mergeCachedDisplayData(raw) {
-    const cached = getSessionDisplayData(raw.uuid);
-    const cachedProducts = /* @__PURE__ */ new Map();
-    const productKey = (code) => code ? `code:${code}` : void 0;
-    for (const p of cached?.products ?? []) {
-      const key = productKey(p.code);
-      if (key) cachedProducts.set(key, p);
-    }
-    const mergedProducts = (raw.products ?? []).map((p) => {
-      const key = productKey(p.code);
-      const fallback = key ? cachedProducts.get(key) : void 0;
-      return {
-        ...p,
-        name: p.name ?? fallback?.name ?? null,
-        totalAmount: p.totalAmount ?? fallback?.totalAmount,
-        overrideAmount: p.overrideAmount ?? fallback?.overrideAmount,
-        currency: p.currency ?? fallback?.currency
-      };
-    });
-    return {
-      ...raw,
-      currency: raw.currency ?? cached?.currency,
-      products: mergedProducts
-    };
-  }
-};
-function createInstrumentedPaymentAPI(billingApiUrl, hooks) {
-  const InstrumentedPaymentAPI = PaymentAPI;
-  return new InstrumentedPaymentAPI(billingApiUrl, hooks);
-}
-
-// src/stripe-adapter.ts
-function toStripeElementType(type) {
-  const map = {
-    payment: "payment",
-    address: "address"
-  };
-  return map[type];
-}
-function toStripeAppearanceTheme(theme) {
-  switch (theme) {
-    case "night":
-      return "night";
-    case "flat":
-      return "flat";
-    // 'default', 'none', undefined, or any unexpected value → Stripe's baseline.
-    default:
-      return "stripe";
-  }
-}
-function paymentMethodTypesKey(paymentMethodTypes) {
-  return paymentMethodTypes ? JSON.stringify(paymentMethodTypes.map((paymentMethodType) => paymentMethodType.trim().toLowerCase())) : null;
-}
-function wrapStripeElement(stripeElement) {
-  const el = stripeElement;
-  return {
-    mount(container) {
-      el.mount(container);
-    },
-    unmount() {
-      el.unmount();
-    },
-    update(options) {
-      el.update(options);
-    },
-    on(event, handler) {
-      el["on"]?.(event, handler);
-    },
-    off(event, handler) {
-      el["off"]?.(event, handler);
-    },
-    destroy() {
-      el.destroy();
-    }
-  };
-}
-function toStripeBillingDetails(billing) {
-  return {
-    billing_details: {
-      ...billing.email ? { email: billing.email } : {},
-      ...billing.name ? { name: billing.name } : {},
-      ...billing.address ? {
-        address: {
-          ...billing.address.country ? { country: billing.address.country } : {},
-          ...billing.address.postal_code ? { postal_code: billing.address.postal_code } : {},
-          ...billing.address.city ? { city: billing.address.city } : {},
-          ...billing.address.line1 ? { line1: billing.address.line1 } : {},
-          ...billing.address.line2 ? { line2: billing.address.line2 } : {},
-          ...billing.address.state ? { state: billing.address.state } : {}
-        }
-      } : {}
-    }
-  };
-}
-var StripeAdapter = class {
-  constructor() {
-    this.name = "stripe";
-    this.stripe = null;
-    this.elements = null;
-    // Serialized appearance currently applied to `this.elements`. Used to detect
-    // when consumers swap themes mid-session so we can live-update the Stripe
-    // Elements group instead of returning a stale-styled cache. `null` while no
-    // elements group exists.
-    this.appliedAppearanceKey = null;
-    this.appliedPaymentMethodTypesKey = null;
-    this.appliedClientSecret = null;
-    this.verifiedClientSecret = null;
-    this.verifiedPaymentMethodTypesKey = null;
-  }
-  async initialize(config) {
-    if (typeof window === "undefined") {
-      return;
-    }
-    const stripe = await (0, import_stripe_js.loadStripe)(config.publishableKey, {
-      locale: config.locale ?? "auto"
-    });
-    if (!stripe) {
-      throw new import_shared3.FloPayError(
-        "Failed to initialize Stripe. Check your publishable key.",
-        "authentication_error"
-      );
-    }
-    this.stripe = stripe;
-  }
-  /** Lazily creates the Stripe Elements group for the given options. */
-  getElements(options) {
-    if (!this.stripe) {
-      throw new import_shared3.FloPayError(
-        "StripeAdapter not initialized. Call initialize() first.",
-        "api_error"
-      );
-    }
-    const stripeAppearance = options?.appearance ? {
-      theme: toStripeAppearanceTheme(options.appearance.theme),
-      variables: options.appearance.variables,
-      rules: options.appearance.rules
-    } : void 0;
-    const nextAppearanceKey = stripeAppearance ? JSON.stringify(stripeAppearance) : null;
-    const nextPaymentMethodTypesKey = paymentMethodTypesKey(options?.paymentMethodTypes);
-    const nextClientSecret = options?.clientSecret ?? null;
-    if (this.elements && nextPaymentMethodTypesKey && (nextPaymentMethodTypesKey !== this.appliedPaymentMethodTypesKey || nextClientSecret !== this.appliedClientSecret)) {
-      this.elements = null;
-      this.appliedAppearanceKey = null;
-      this.appliedPaymentMethodTypesKey = null;
-      this.appliedClientSecret = null;
-      this.verifiedClientSecret = null;
-      this.verifiedPaymentMethodTypesKey = null;
-    }
-    if (!this.elements) {
-      let elementsOptions;
-      const deferredAmount = options?.amount ?? 0;
-      const deferredCurrency = (options?.currency ?? "usd").toLowerCase();
-      const paymentMethodCreation = options?.paymentMethodCreation ?? "manual";
-      if (options?.clientSecret) {
-        elementsOptions = { clientSecret: options.clientSecret };
-      } else if (deferredAmount > 0) {
-        elementsOptions = {
-          mode: "payment",
-          amount: deferredAmount,
-          currency: deferredCurrency,
-          paymentMethodCreation
-        };
-        if (options?.setupFutureUsage) {
-          elementsOptions["setupFutureUsage"] = options.setupFutureUsage;
-        }
-      } else {
-        elementsOptions = {
-          mode: "setup",
-          currency: deferredCurrency,
-          paymentMethodCreation
-        };
-      }
-      if (!options?.clientSecret && options?.paymentMethodTypes) {
-        elementsOptions["paymentMethodTypes"] = options.paymentMethodTypes;
-      }
-      if (stripeAppearance) {
-        elementsOptions["appearance"] = stripeAppearance;
-      }
-      this.elements = this.stripe.elements(elementsOptions);
-      this.appliedAppearanceKey = nextAppearanceKey;
-      this.appliedPaymentMethodTypesKey = nextPaymentMethodTypesKey;
-      this.appliedClientSecret = nextClientSecret;
-      this.verifiedClientSecret = null;
-      this.verifiedPaymentMethodTypesKey = null;
-    } else if (nextAppearanceKey !== this.appliedAppearanceKey) {
-      this.elements.update({
-        appearance: stripeAppearance ?? {}
-      });
-      this.appliedAppearanceKey = nextAppearanceKey;
-    }
-    return this.elements;
-  }
-  async assertClientSecretPaymentMethods(clientSecret, allowedPaymentMethodTypes) {
-    if (!this.stripe) {
-      throw new import_shared3.FloPayError(
-        "StripeAdapter not initialized. Call initialize() first.",
-        "api_error"
-      );
-    }
-    let intent;
-    let retrievalFailed = false;
-    if ((0, import_shared3.isSetupIntentClientSecret)(clientSecret)) {
-      const { setupIntent, error } = await this.stripe.retrieveSetupIntent(clientSecret);
-      intent = setupIntent;
-      retrievalFailed = Boolean(error);
-    } else {
-      const { paymentIntent, error } = await this.stripe.retrievePaymentIntent(clientSecret);
-      intent = paymentIntent;
-      retrievalFailed = Boolean(error);
-    }
-    const providerPaymentMethodTypes = intent?.payment_method_types;
-    if (retrievalFailed || !Array.isArray(providerPaymentMethodTypes)) {
-      throw new import_shared3.FloPayError(
-        "Unable to verify the payment methods configured for this client secret.",
-        "api_error",
-        { param: "clientSecret" }
-      );
-    }
-    const allowlist = new Set(
-      allowedPaymentMethodTypes.map((paymentMethodType) => paymentMethodType.toLowerCase())
-    );
-    const hasDisallowedProviderMethod = providerPaymentMethodTypes.some(
-      (paymentMethodType) => typeof paymentMethodType !== "string" || !allowlist.has(paymentMethodType.trim().toLowerCase())
-    );
-    if (hasDisallowedProviderMethod || providerPaymentMethodTypes.length === 0) {
-      throw new import_shared3.FloPayError(
-        "The client-secret intent must enable only declared non-card payment methods.",
-        "validation_error",
-        { param: "clientSecret" }
-      );
-    }
-  }
-  async createElement(type, options) {
-    let resolvedOptions = options;
-    if (type === "payment") {
-      const paymentMethodTypes = options.paymentMethodTypes?.map((paymentMethodType) => paymentMethodType.trim()).filter((paymentMethodType) => paymentMethodType && paymentMethodType.toLowerCase() !== "card");
-      if (!paymentMethodTypes?.length) {
-        throw new import_shared3.FloPayError(
-          "At least one supported non-card payment method is required.",
-          "validation_error",
-          { param: "paymentMethodTypes" }
-        );
-      }
-      resolvedOptions = { ...options, paymentMethodTypes };
-      if (resolvedOptions.clientSecret) {
-        const resolvedPaymentMethodTypesKey = paymentMethodTypesKey(paymentMethodTypes);
-        const verificationIsCached = Boolean(
-          this.elements && this.appliedClientSecret === resolvedOptions.clientSecret && this.appliedPaymentMethodTypesKey === resolvedPaymentMethodTypesKey && this.verifiedClientSecret === resolvedOptions.clientSecret && this.verifiedPaymentMethodTypesKey === resolvedPaymentMethodTypesKey
-        );
-        if (!verificationIsCached) {
-          await this.assertClientSecretPaymentMethods(
-            resolvedOptions.clientSecret,
-            paymentMethodTypes
-          );
-        }
-      }
-    }
-    const elements = this.getElements(resolvedOptions);
-    if (type === "payment" && resolvedOptions.clientSecret) {
-      this.verifiedClientSecret = resolvedOptions.clientSecret;
-      this.verifiedPaymentMethodTypesKey = paymentMethodTypesKey(
-        resolvedOptions.paymentMethodTypes
-      );
-    }
-    const stripeType = toStripeElementType(type);
-    const elementOptions = {};
-    if (resolvedOptions.layout) {
-      elementOptions["layout"] = resolvedOptions.layout;
-    }
-    if (resolvedOptions.defaultValues) {
-      elementOptions["defaultValues"] = resolvedOptions.defaultValues;
-    }
-    if (resolvedOptions.readOnly) {
-      elementOptions["readOnly"] = resolvedOptions.readOnly;
-    }
-    if (resolvedOptions.mode) {
-      elementOptions["mode"] = resolvedOptions.mode;
-    }
-    const stripeElement = elements.create(stripeType, elementOptions);
-    return wrapStripeElement(stripeElement);
-  }
-  getElement(type) {
-    if (!this.elements) return null;
-    const stripeType = toStripeElementType(type);
-    const existing = this.elements.getElement(stripeType);
-    if (!existing) return null;
-    return wrapStripeElement(existing);
-  }
-  async submitElements() {
-    if (!this.stripe || !this.elements) {
-      return { error: new import_shared3.FloPayError("Stripe not initialized", "api_error") };
-    }
-    const { error } = await this.elements.submit();
-    if (error) {
-      return {
-        error: new import_shared3.FloPayError(error.message ?? "Validation failed", "validation_error")
-      };
-    }
-    return {};
-  }
-  async confirmPayment(params) {
-    if (!this.stripe || !this.elements) {
-      throw new import_shared3.FloPayError(
-        "StripeAdapter not initialized or no elements created.",
-        "api_error"
-      );
-    }
-    const billing = params.billingDetails;
-    const paymentMethodData = billing ? toStripeBillingDetails(billing) : void 0;
-    const { error, paymentIntent } = await this.stripe.confirmPayment({
-      elements: this.elements,
-      clientSecret: params.clientSecret,
-      confirmParams: {
-        return_url: params.returnUrl ?? window.location.href,
-        ...paymentMethodData ? { payment_method_data: paymentMethodData } : {}
-      },
-      redirect: "if_required"
-    });
-    if (error) {
-      return {
-        status: "failed",
-        error: new import_shared3.FloPayError(
-          error.message ?? "Payment failed",
-          "api_error",
-          {
-            code: error.code,
-            declineCode: error.decline_code
-          }
-        )
-      };
-    }
-    if (!paymentIntent) {
-      return { status: "failed", error: new import_shared3.FloPayError("No payment intent returned", "api_error") };
-    }
-    const statusMap = {
-      succeeded: "succeeded",
-      processing: "processing",
-      requires_action: "requires_action",
-      requires_payment_method: "failed",
-      canceled: "failed"
-    };
-    return {
-      status: statusMap[paymentIntent.status] ?? "failed",
-      paymentIntentId: paymentIntent.id,
-      paymentMethodId: this.extractPaymentMethodId(paymentIntent.payment_method)
-    };
-  }
-  extractPaymentMethodId(paymentMethod) {
-    if (typeof paymentMethod === "string" && paymentMethod.startsWith("pm_")) {
-      return paymentMethod;
-    }
-    if (paymentMethod && typeof paymentMethod === "object" && typeof paymentMethod.id === "string") {
-      return paymentMethod.id;
-    }
-    return void 0;
-  }
-  async confirmPayPalPayment(params) {
-    if (!this.stripe) {
-      return { status: "failed", error: new import_shared3.FloPayError("Stripe not initialized", "api_error") };
-    }
-    const baseUrl = params.billingApiUrl.replace(/\/+$/, "");
-    if (this.elements) {
-      const { error: submitError } = await this.elements.submit();
-      if (submitError) {
-        return {
-          status: "failed",
-          error: new import_shared3.FloPayError(
-            submitError.message ?? "PayPal payment failed",
-            "validation_error",
-            { code: submitError.code }
-          )
-        };
-      }
-    }
-    let intentClientSecret;
-    try {
-      const intent = await new PaymentAPI(baseUrl).createSessionIntent(
-        params.sessionId,
-        params.nonce ?? "",
-        {
-          provider: "stripe",
-          paymentMethodCategory: "wallet",
-          paymentMethodType: "paypal",
-          paymentMethodId: null,
-          intentKind: "payment"
-        }
-      );
-      if (intent.provider !== "stripe") {
-        throw new import_shared3.FloPayError("Invalid provider returned for PayPal intent", "api_error");
-      }
-      intentClientSecret = intent.clientSecret;
-    } catch (error2) {
-      return {
-        status: "failed",
-        error: error2 instanceof import_shared3.FloPayError ? error2 : new import_shared3.FloPayError("Failed to create PayPal payment intent", "api_error")
-      };
-    }
-    const { error } = await this.stripe.confirmPayment({
-      clientSecret: intentClientSecret,
-      elements: this.elements ?? void 0,
-      confirmParams: { return_url: params.returnUrl }
-    });
-    if (error) {
-      if (params.nonce) {
-        try {
-          await new PaymentAPI(baseUrl).reportSessionIntentDecline(
-            params.sessionId,
-            params.nonce,
-            {
-              provider: "stripe",
-              paymentMethodCategory: "wallet",
-              paymentMethodType: "paypal",
-              providerDeclineReason: error.code ?? "provider_declined"
-            }
-          );
-        } catch {
-        }
-      }
-      return {
-        status: "failed",
-        error: new import_shared3.FloPayError(error.message ?? "PayPal payment failed", "api_error", { code: error.code })
-      };
-    }
-    return {
-      status: "processing"
-    };
-  }
-  async resumePayPalPayment() {
-    if (!this.stripe || typeof window === "undefined") return null;
-    const params = new URLSearchParams(window.location.search);
-    const paymentIntentId = params.get("payment_intent");
-    const clientSecret = params.get("payment_intent_client_secret");
-    const redirectStatus = params.get("redirect_status");
-    if (!paymentIntentId || !clientSecret) return null;
-    if (redirectStatus === "failed") {
-      return {
-        status: "failed",
-        error: new import_shared3.FloPayError("PayPal payment was declined. Please try again.", "api_error")
-      };
-    }
-    const { paymentIntent, error } = await this.stripe.retrievePaymentIntent(clientSecret);
-    if (error) {
-      return {
-        status: "failed",
-        error: new import_shared3.FloPayError(error.message ?? "Failed to retrieve PayPal payment", "api_error")
-      };
-    }
-    if (paymentIntent && (paymentIntent.status === "requires_capture" || paymentIntent.status === "succeeded")) {
-      const pmId = typeof paymentIntent.payment_method === "string" ? paymentIntent.payment_method : paymentIntent.payment_method?.id;
-      const url = new URL(window.location.href);
-      url.searchParams.delete("payment_intent");
-      url.searchParams.delete("payment_intent_client_secret");
-      url.searchParams.delete("redirect_status");
-      window.history.replaceState({}, "", url.toString());
-      return {
-        status: paymentIntent.status,
-        paymentIntentId: paymentIntent.id,
-        paymentMethodId: pmId
-      };
-    }
-    return {
-      status: "failed",
-      error: new import_shared3.FloPayError("PayPal payment was not completed. Please try again.", "api_error")
-    };
-  }
-  getRawProvider() {
-    return this.stripe;
-  }
-  createPayPalElements(options) {
-    if (!this.stripe) return null;
-    const elementsOptions = {
-      mode: "payment",
-      amount: options.amount ?? 0,
-      currency: (options.currency ?? "usd").toLowerCase(),
-      captureMethod: "manual"
-    };
-    if (options.setupFutureUsage) {
-      elementsOptions["setupFutureUsage"] = options.setupFutureUsage;
-    }
-    if (options.appearance) {
-      elementsOptions["appearance"] = {
-        theme: toStripeAppearanceTheme(options.appearance.theme),
-        variables: options.appearance.variables,
-        rules: options.appearance.rules
-      };
-    }
-    return this.stripe.elements(elementsOptions);
-  }
-  destroy() {
-    this.elements = null;
-    this.appliedAppearanceKey = null;
-    this.appliedPaymentMethodTypesKey = null;
-    this.appliedClientSecret = null;
-    this.verifiedClientSecret = null;
-    this.verifiedPaymentMethodTypesKey = null;
-    this.stripe = null;
-  }
-};
-
-// src/flopay.ts
-var import_shared6 = require("@flopay/shared");
-
-// src/elements.ts
-var import_shared4 = require("@flopay/shared");
-var FloPayElements = class {
-  constructor(provider, options) {
-    this.elementMap = /* @__PURE__ */ new Map();
-    this.provider = provider;
-    this.baseOptions = options ?? {};
-  }
-  /**
-   * Creates a new element of the given type.
-   * If an element of that type already exists, it is destroyed first.
-   */
-  async create(type, options) {
-    const merged = { ...this.baseOptions, ...options };
-    if (type === "payment") {
-      const paymentMethodTypes = merged.paymentMethodTypes?.map((paymentMethodType) => paymentMethodType.trim()).filter((paymentMethodType) => paymentMethodType && paymentMethodType.toLowerCase() !== "card");
-      if (!paymentMethodTypes?.length) {
-        throw new import_shared4.FloPayError(
-          "At least one supported non-card payment method is required.",
-          "validation_error",
-          { param: "paymentMethodTypes" }
-        );
-      }
-      merged.paymentMethodTypes = paymentMethodTypes;
-    }
-    const providerExisting = this.provider.getElement(type);
-    if (providerExisting) {
-      this.elementMap.set(type, providerExisting);
-      return providerExisting;
-    }
-    const existing = this.elementMap.get(type);
-    if (existing) {
-      existing.destroy();
-    }
-    const element = await this.provider.createElement(type, merged);
-    this.elementMap.set(type, element);
-    return element;
-  }
-  /** Returns a previously created element, or `null`. */
-  getElement(type) {
-    return this.elementMap.get(type) ?? null;
-  }
-  /**
-   * Submits all mounted elements for validation.
-   *
-   * Returns an object with an optional error if validation fails.
-   * This does NOT confirm the payment — call `floPay.confirmPayment()` for that.
-   */
-  async submit() {
-    return {};
-  }
-  /** Destroys all created elements and clears the internal map. */
-  destroy() {
-    for (const element of this.elementMap.values()) {
-      element.destroy();
-    }
-    this.elementMap.clear();
-  }
-};
-
-// src/pci-vault-card-capture.ts
-var import_shared5 = require("@flopay/shared");
-var VAULT_MESSAGE_SOURCE = "flopay-vault";
-var VAULT_NON_TERMINAL_OUTCOME_LOGS = {
-  ready: ["vault.widget.ready", "vault_ready"],
-  submitting: ["vault.submission.started", "vault_submit"],
-  blocked: ["operation.state_transition", "vault_submit"],
-  action_required: ["vault.action.required", "three_ds_handoff"]
-};
-function addBreadcrumb(event) {
-  const data = {
-    class: event.class,
-    stage: event.stage
-  };
-  if ("code" in event) data["code"] = event.code;
-  if ("provider" in event && event.provider) data["provider"] = event.provider;
-  if ("paymentMethodCategory" in event && event.paymentMethodCategory) {
-    data["paymentMethodCategory"] = event.paymentMethodCategory;
-  }
-  if ("outcome" in event) data["outcome"] = event.outcome;
-  if ("durationMs" in event && event.durationMs !== void 0) data["durationMs"] = event.durationMs;
-  if ("durationMode" in event && event.durationMode) data["durationMode"] = event.durationMode;
-  try {
-    const sentry = globalThis.Sentry;
-    sentry?.addBreadcrumb?.({
-      category: "flopay.telemetry",
-      level: event.class === "technical_error" ? "error" : "info",
-      message: event.class === "lifecycle" ? event.name : event.class === "technical_error" ? event.code : event.class === "expected_outcome" ? event.outcome : "sdk.performance",
-      data
-    });
-  } catch {
-  }
-}
-function vaultLog(name, stage) {
-  return (0, import_shared5.buildTelemetryLogEvent)({
-    eventId: "11111111-1111-4111-8111-111111111111",
-    name,
-    stage,
-    sequence: 0,
-    provider: "pcivault",
-    paymentMethodCategory: "card"
-  });
-}
-function vaultErrorClassification(submissionStarted) {
-  return submissionStarted ? { errorCode: "VAULT_SUBMIT_FAILED", stage: "vault_submit" } : { errorCode: "VAULT_LOAD_FAILED", stage: "vault_mount" };
-}
-function vaultOutcomeBreadcrumb(type, submissionStarted) {
-  if (type === "complete" || type === "decline") {
-    return (0, import_shared5.buildTelemetryTerminalEvent)({
-      eventId: "22222222-2222-4222-8222-222222222222",
-      outcome: type === "complete" ? "payment_succeeded" : "payment_declined",
-      sequence: 0,
-      provider: "pcivault",
-      paymentMethodCategory: "card"
-    });
-  }
-  if (type === "error") {
-    const classification = vaultErrorClassification(submissionStarted);
-    return (0, import_shared5.buildTelemetryErrorEvent)({
-      eventId: "33333333-3333-4333-8333-333333333333",
-      ...classification,
-      sequence: 0,
-      provider: "pcivault",
-      paymentMethodCategory: "card"
-    });
-  }
-  const [name, stage] = VAULT_NON_TERMINAL_OUTCOME_LOGS[type];
-  return vaultLog(name, stage);
-}
-function isVaultResultMessage(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const record = value;
-  return record["source"] === VAULT_MESSAGE_SOURCE && (record["type"] === "ready" || record["type"] === "submitting" || record["type"] === "blocked" || record["type"] === "complete" || record["type"] === "decline" || record["type"] === "error" || record["type"] === "action_required");
-}
-function isVaultValidationMessage(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const record = value;
-  return record["source"] === VAULT_MESSAGE_SOURCE && record["type"] === "validation" && Array.isArray(record["messages"]);
-}
-function isVaultResizeMessage(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const record = value;
-  return record["source"] === VAULT_MESSAGE_SOURCE && record["type"] === "resize" && typeof record["height"] === "number" && Number.isFinite(record["height"]);
-}
-var PciVaultCardCapture = class {
-  constructor(config = {}, internalTelemetry) {
-    this.provider = "pcivault";
-    this.container = null;
-    this.messageHandler = null;
-    /**
-     * Parent-page-level overlay rendering the provider's verification challenge
-     * (3DS-2 iframe) on `action_required`. Owned by the adapter — not the
-     * widget — so it can sit above the host SDK's processing backdrop, which
-     * would otherwise visually cover an in-widget challenge iframe.
-     */
-    this.actionOverlay = null;
-    /**
-     * Listener that catches the `flopay-vault-3ds-return` postMessage from the
-     * provider's challenge return page. When the SDK owns the challenge iframe
-     * the return page lives inside *that* iframe (not the widget's), so
-     * `window.parent` is the host page — the widget's existing message
-     * listener can't see it. The SDK forwards completion into the widget via
-     * `action_completed` so the widget kicks `/3ds/complete` immediately
-     * instead of waiting on the eventual provider webhook.
-     */
-    this.threeDsReturnHandler = null;
-    /** Per-session integrity token to require on outcomes (from mount options). */
-    this.messageToken = null;
-    /** Strict origin to require on outcomes, when configured. */
-    this.expectedOrigin = null;
-    /** Latest merchant theme to push into the (cross-origin) widget. */
-    this.theme = null;
-    /** Latest host submit-gate state to push into the widget (block its submit). */
-    this.submitGateBlocked = false;
-    /** Latest card-field order + autofocus directive to push into the widget. */
-    this.cardFieldOrder = null;
-    this.cardAutoFocus = true;
-    this.captureRequestedAt = 0;
-    this.vaultReadyReported = false;
-    this.submissionStarted = false;
-    this.submissionStartedAt = null;
-    this.listeners = /* @__PURE__ */ new Map();
-    this.config = config;
-    this.ownsTelemetryReporter = !internalTelemetry && config.telemetry !== false;
-    this.telemetryReporter = internalTelemetry?.reporter ?? (this.ownsTelemetryReporter ? new TelemetryReporter({
-      billingApiUrl: (0, import_shared5.resolveBillingApiUrl)(),
-      sdkVersion: import_shared5.SDK_VERSION
-    }) : void 0);
-    this.requestedAt = internalTelemetry?.requestedAt;
-  }
-  async mount(container, options) {
-    if (this.ownsTelemetryReporter && !this.telemetryReporter) {
-      this.telemetryReporter = new TelemetryReporter({
-        billingApiUrl: (0, import_shared5.resolveBillingApiUrl)(),
-        sdkVersion: import_shared5.SDK_VERSION
-      });
-    }
-    const mountedAt = this.telemetryReporter?.now?.() ?? telemetryNow();
-    this.captureRequestedAt = this.requestedAt ?? mountedAt;
-    this.vaultReadyReported = false;
-    this.submissionStarted = false;
-    this.submissionStartedAt = null;
-    if (typeof window === "undefined" || typeof document === "undefined") {
-      this.reportVaultLoadFailure();
-      throw new import_shared5.FloPayError(
-        "The vault card form is only available in the browser.",
-        "api_error",
-        { code: "card_capture_no_window" }
-      );
-    }
-    if (!options?.html || !options.html.trim()) {
-      this.reportVaultLoadFailure();
-      throw new import_shared5.FloPayError(
-        "No vault capture widget HTML was provided to mount the secure card form.",
-        "api_error",
-        { code: "card_capture_no_widget_html" }
-      );
-    }
-    this.container = container;
-    this.messageToken = options.messageToken ?? null;
-    this.expectedOrigin = options.expectedOrigin ?? this.config.expectedOrigin ?? null;
-    this.theme = options.theme ?? null;
-    try {
-      this.attachMessageListener();
-      this.injectWidget(container, options.html);
-    } catch (error) {
-      this.reportVaultLoadFailure();
-      throw error;
-    }
-    this.postTheme();
-    this.postSubmitGate();
-    this.postCardFieldOrder();
-    addBreadcrumb(vaultLog("vault.widget.mounted", "vault_mount"));
-    this.telemetryReporter?.log({
-      name: "vault.widget.mounted",
-      stage: "vault_mount",
-      provider: "pcivault",
-      paymentMethodCategory: "card"
-    });
-    this.emit("ready", { sessionId: this.config.sessionId });
-  }
-  reportVaultLoadFailure() {
-    this.telemetryReporter?.error({
-      errorCode: "VAULT_LOAD_FAILED",
-      stage: "vault_mount",
-      provider: "pcivault",
-      paymentMethodCategory: "card"
-    });
-  }
-  on(event, handler) {
-    let set = this.listeners.get(event);
-    if (!set) {
-      set = /* @__PURE__ */ new Set();
-      this.listeners.set(event, set);
-    }
-    set.add(handler);
-    return () => {
-      this.listeners.get(event)?.delete(handler);
-    };
-  }
-  unmount() {
-    this.hideActionRequiredOverlay();
-    if (this.messageHandler) {
-      window.removeEventListener("message", this.messageHandler);
-      this.messageHandler = null;
-    }
-    if (this.container) {
-      this.container.replaceChildren();
-      this.container = null;
-    }
-    this.messageToken = null;
-    this.expectedOrigin = null;
-    if (this.ownsTelemetryReporter) {
-      this.telemetryReporter?.destroy();
-      this.telemetryReporter = void 0;
-    }
-  }
-  // ── internals ──
-  /**
-   * Inject the server-rendered widget HTML. `innerHTML` does not execute
-   * embedded `<script>` tags, so each script node is replaced with a freshly
-   * created element that the browser will load and run (this is what boots the
-   * PCIVault form bundle against the `data-flopay-config` container).
-   */
-  injectWidget(container, html) {
-    container.innerHTML = html;
-    const scripts = Array.from(container.querySelectorAll("script"));
-    for (const oldScript of scripts) {
-      const script = document.createElement("script");
-      for (const attr of Array.from(oldScript.attributes)) {
-        script.setAttribute(attr.name, attr.value);
-      }
-      script.text = oldScript.text;
-      oldScript.replaceWith(script);
-    }
-  }
-  attachMessageListener() {
-    if (this.messageHandler) return;
-    const handler = (event) => {
-      if (this.expectedOrigin && event.origin !== this.expectedOrigin) return;
-      const data = event.data;
-      if (isVaultResizeMessage(data)) {
-        if (this.messageToken && data.messageToken !== this.messageToken) return;
-        this.applyHeight(data.height);
-        return;
-      }
-      if (isVaultValidationMessage(data)) {
-        if (this.messageToken && data.messageToken !== this.messageToken) return;
-        const text = data.messages.filter((m) => typeof m === "string" && m.trim()).join(" ");
-        this.emit("validation", { sessionId: this.config.sessionId, message: text || void 0 });
-        return;
-      }
-      if (!isVaultResultMessage(data)) return;
-      if (this.messageToken && data.messageToken !== this.messageToken) return;
-      const boundSession = this.config.sessionId;
-      const incomingSession = typeof data.sessionId === "string" ? data.sessionId : void 0;
-      if (boundSession && incomingSession && incomingSession !== boundSession) {
-        return;
-      }
-      if ((data.type === "complete" || data.type === "decline") && boundSession && incomingSession !== boundSession) {
-        return;
-      }
-      const outcome = {
-        sessionId: data.sessionId ?? this.config.sessionId,
-        intentId: data.intentId,
-        declineReason: data.declineReason,
-        message: data.message,
-        nextActionRedirectUrl: data.nextActionRedirectUrl
-      };
-      if (data.type === "submitting") {
-        this.submissionStarted = true;
-        this.submissionStartedAt = this.telemetryReporter?.now?.() ?? telemetryNow();
-      }
-      addBreadcrumb(vaultOutcomeBreadcrumb(data.type, this.submissionStarted));
-      this.reportOutcome(data.type);
-      if (data.type === "ready") {
-        this.postTheme();
-        this.postSubmitGate();
-        this.postCardFieldOrder();
-      }
-      if (data.type === "action_required" && data.nextActionRedirectUrl) {
-        this.showActionRequiredOverlay(data.nextActionRedirectUrl);
-      }
-      if (data.type === "complete" || data.type === "decline" || data.type === "error" || data.type === "submitting") {
-        this.hideActionRequiredOverlay();
-      }
-      this.emit(data.type, outcome);
-    };
-    this.messageHandler = handler;
-    window.addEventListener("message", handler);
-  }
-  reportOutcome(type) {
-    const reporter = this.telemetryReporter;
-    if (!reporter) return;
-    if (type === "ready" && !this.vaultReadyReported) {
-      this.vaultReadyReported = true;
-      reporter.performance({
-        stage: "vault_ready",
-        durationMs: Math.max(0, reporter.now() - this.captureRequestedAt),
-        durationMode: "machine",
-        provider: "pcivault",
-        paymentMethodCategory: "card"
-      });
-    }
-    if (type === "complete" || type === "decline") {
-      reporter.log({
-        name: "vault.terminal",
-        stage: "completion",
-        provider: "pcivault",
-        paymentMethodCategory: "card"
-      });
-      reporter.terminal({
-        outcome: type === "complete" ? "payment_succeeded" : "payment_declined",
-        provider: "pcivault",
-        paymentMethodCategory: "card"
-      });
-      return;
-    }
-    if (type === "error") {
-      const classification = vaultErrorClassification(this.submissionStarted);
-      reporter.log({
-        name: "vault.terminal",
-        stage: classification.stage,
-        provider: "pcivault",
-        paymentMethodCategory: "card"
-      });
-      reporter.error({
-        ...classification,
-        provider: "pcivault",
-        paymentMethodCategory: "card"
-      });
-      return;
-    }
-    if (type === "action_required") {
-      reporter.log({
-        name: "vault.action.required",
-        stage: "three_ds_handoff",
-        provider: "pcivault",
-        paymentMethodCategory: "card"
-      });
-      reporter.log({
-        name: "vault.three_ds.handoff",
-        stage: "three_ds_handoff",
-        provider: "pcivault",
-        paymentMethodCategory: "card"
-      });
-      const submissionStartedAt = this.submissionStartedAt;
-      this.submissionStartedAt = null;
-      if (submissionStartedAt !== null) {
-        reporter.performance({
-          stage: "three_ds_handoff",
-          durationMs: Math.max(0, reporter.now() - submissionStartedAt),
-          durationMode: "machine",
-          provider: "pcivault",
-          paymentMethodCategory: "card"
-        });
-      }
-      reporter.terminal({
-        outcome: "action_required",
-        stage: "three_ds_handoff",
-        provider: "pcivault",
-        paymentMethodCategory: "card"
-      });
-      return;
-    }
-    const [name, stage] = VAULT_NON_TERMINAL_OUTCOME_LOGS[type];
-    reporter.log({
-      name,
-      stage,
-      provider: "pcivault",
-      paymentMethodCategory: "card"
-    });
-  }
-  /**
-   * Push merchant theme colors into the hosted widget (live). The host calls
-   * this on a runtime theme switch; the widget applies them to its CSS variables
-   * without a remount. Stores the latest theme so `ready` can re-push it.
-   */
-  applyTheme(theme) {
-    this.theme = theme;
-    this.postTheme();
-  }
-  /** postMessage the current theme to the widget's (cross-origin) document. */
-  postTheme() {
-    if (!this.theme || !this.container) return;
-    const iframe = this.container.querySelector("iframe");
-    const target = iframe?.contentWindow;
-    if (!target) return;
-    try {
-      target.postMessage({ source: "flopay-vault-host", type: "theme", theme: this.theme }, "*");
-    } catch {
-    }
-  }
-  /**
-   * Gate the widget's submit from the host. When `blocked`, the widget cancels
-   * its next submit and emits `'blocked'` instead of `'submitting'` so the host
-   * can validate merchant-DOM fields (AVS) first. Stored so `ready` re-pushes it.
-   */
-  setSubmitGate(blocked) {
-    this.submitGateBlocked = blocked;
-    this.postSubmitGate();
-  }
-  /** postMessage the current submit-gate state to the widget's document. */
-  postSubmitGate() {
-    if (!this.container) return;
-    const iframe = this.container.querySelector("iframe");
-    const target = iframe?.contentWindow;
-    if (!target) return;
-    try {
-      target.postMessage(
-        { source: "flopay-vault-host", type: "gate", blocked: this.submitGateBlocked },
-        "*"
-      );
-    } catch {
-    }
-  }
-  /**
-   * Push the card-field order + autofocus directive into the widget (live). The
-   * widget re-sequences its rows (DOM order, so tab order follows) and focuses
-   * its first field unless `autoFocus` is false. Stored so `ready` re-pushes it.
-   */
-  setCardFieldOrder(order, autoFocus) {
-    this.cardFieldOrder = order;
-    this.cardAutoFocus = autoFocus;
-    this.postCardFieldOrder();
-  }
-  /** postMessage the current field order + autofocus to the widget's document. */
-  postCardFieldOrder() {
-    if (!this.container) return;
-    const iframe = this.container.querySelector("iframe");
-    const target = iframe?.contentWindow;
-    if (!target) return;
-    try {
-      target.postMessage(
-        {
-          source: "flopay-vault-host",
-          type: "fieldOrder",
-          order: this.cardFieldOrder,
-          autoFocus: this.cardAutoFocus
-        },
-        "*"
-      );
-    } catch {
-    }
-  }
-  emit(event, payload) {
-    for (const handler of this.listeners.get(event) ?? []) {
-      handler(payload);
-    }
-  }
-  /**
-   * Render the provider-hosted verification challenge (e.g. Stripe 3DS-2) in a
-   * full-page overlay at the PARENT page level. The widget's inline-iframe
-   * approach is unusable because the SDK's processing backdrop sits above the
-   * vault iframe, hiding any challenge mounted inside it — by lifting the
-   * iframe to the host page the adapter can give it a z-index that wins.
-   *
-   * The overlay tears down on the next terminal outcome
-   * (`complete`/`decline`/`error`) or when the buyer closes it via the backdrop
-   * close button. Closing manually is a soft abandon — the next `/status` poll
-   * either reveals a real outcome (the challenge completed via the issuer's
-   * own redirect to `/vault/3ds/return`, which posts back into the widget) or
-   * surfaces `requires_action` again so the host can decide what to do.
-   */
-  showActionRequiredOverlay(challengeUrl) {
-    if (typeof document === "undefined") return;
-    if (this.actionOverlay) {
-      const existingIframe = this.actionOverlay.querySelector("iframe");
-      if (existingIframe instanceof HTMLIFrameElement) {
-        existingIframe.src = challengeUrl;
-      }
-      return;
-    }
-    const backdrop = document.createElement("div");
-    backdrop.setAttribute("data-flopay-action-required", "1");
-    backdrop.style.cssText = [
-      "position:fixed",
-      "inset:0",
-      // Maximum signed 32-bit z-index; the SDK's own processing backdrop sits
-      // well below this so the challenge is visible and interactive.
-      "z-index:2147483647",
-      "background:rgba(15,23,42,0.6)",
-      "display:flex",
-      "align-items:center",
-      "justify-content:center",
-      "padding:16px"
-    ].join(";");
-    const frame = document.createElement("iframe");
-    frame.setAttribute("title", "Card authentication");
-    frame.setAttribute("allow", "payment");
-    frame.style.cssText = [
-      "width:min(100%,460px)",
-      "height:min(100%,640px)",
-      "border:0",
-      "border-radius:12px",
-      "background:#fff",
-      "box-shadow:0 12px 30px rgba(0,0,0,0.35)"
-    ].join(";");
-    frame.src = challengeUrl;
-    backdrop.appendChild(frame);
-    const closeButton = document.createElement("button");
-    closeButton.type = "button";
-    closeButton.setAttribute("aria-label", "Close card authentication");
-    closeButton.textContent = "\xD7";
-    closeButton.style.cssText = [
-      "position:fixed",
-      "top:20px",
-      "right:20px",
-      "width:40px",
-      "height:40px",
-      "border:0",
-      "border-radius:9999px",
-      "background:#fff",
-      "color:#0f172a",
-      "font-size:28px",
-      "line-height:40px",
-      "cursor:pointer",
-      "box-shadow:0 4px 14px rgba(0,0,0,0.25)"
-    ].join(";");
-    closeButton.addEventListener("click", () => this.abandonActionRequiredOverlay());
-    backdrop.appendChild(closeButton);
-    backdrop.addEventListener("click", (event) => {
-      if (event.target === backdrop) this.abandonActionRequiredOverlay();
-    });
-    const returnHandler = (event) => {
-      if (event.source !== frame.contentWindow) return;
-      const data = event.data;
-      if (!data || typeof data !== "object") return;
-      const record = data;
-      if (record["source"] !== "flopay-vault-3ds-return") return;
-      addBreadcrumb(vaultLog("vault.three_ds.returned", "three_ds_return"));
-      this.telemetryReporter?.log({
-        name: "vault.three_ds.returned",
-        stage: "three_ds_return",
-        provider: "pcivault",
-        paymentMethodCategory: "card"
-      });
-      this.hideActionRequiredOverlay();
-      this.postActionCompleted(record["status"]);
-    };
-    window.addEventListener("message", returnHandler);
-    this.threeDsReturnHandler = returnHandler;
-    document.body.appendChild(backdrop);
-    this.actionOverlay = backdrop;
-    addBreadcrumb(vaultLog("vault.three_ds.handoff", "three_ds_handoff"));
-  }
-  /**
-   * Tell the vault widget that the buyer has completed (or abandoned) the
-   * challenge. The widget responds by POSTing `/3ds/complete` — its
-   * sub-300ms sync resolver writes the follow-up attempt row immediately,
-   * so the next `/status` poll resolves to a terminal outcome instead of
-   * waiting for the eventual provider webhook.
-   */
-  postActionCompleted(status) {
-    if (!this.container) return;
-    const iframe = this.container.querySelector("iframe");
-    const target = iframe?.contentWindow;
-    if (!target) return;
-    try {
-      target.postMessage(
-        {
-          source: "flopay-vault-host",
-          type: "action_completed",
-          status: typeof status === "string" ? status : "unknown"
-        },
-        "*"
-      );
-    } catch {
-    }
-  }
-  abandonActionRequiredOverlay() {
-    if (!this.actionOverlay) return;
-    const breadcrumb = (0, import_shared5.buildTelemetryTerminalEvent)({
-      eventId: "77777777-7777-4777-8777-777777777777",
-      outcome: "customer_abandoned",
-      stage: "three_ds_handoff",
-      sequence: 0,
-      provider: "pcivault",
-      paymentMethodCategory: "card"
-    });
-    addBreadcrumb(breadcrumb);
-    this.telemetryReporter?.terminal({
-      outcome: "customer_abandoned",
-      stage: "three_ds_handoff",
-      provider: "pcivault",
-      paymentMethodCategory: "card"
-    });
-    this.hideActionRequiredOverlay();
-    this.postActionCompleted("abandoned");
-  }
-  hideActionRequiredOverlay() {
-    if (this.threeDsReturnHandler) {
-      window.removeEventListener("message", this.threeDsReturnHandler);
-      this.threeDsReturnHandler = null;
-    }
-    if (!this.actionOverlay) return;
-    this.actionOverlay.parentNode?.removeChild(this.actionOverlay);
-    this.actionOverlay = null;
-  }
-  /**
-   * Size the hosted-widget iframe to the height reported by the form inside it.
-   * Cross-origin iframes don't auto-size to their content, so the widget posts
-   * its measured height and we apply it here (clamped to a sane range). This is
-   * what lets the card form shrink/grow to fit instead of sitting at a fixed
-   * height.
-   */
-  applyHeight(height) {
-    const iframe = this.container?.querySelector("iframe");
-    if (!iframe) return;
-    const clamped = Math.max(0, Math.min(Math.ceil(height), 2e3));
-    iframe.style.height = `${clamped}px`;
-  }
-};
-function createInstrumentedPciVaultCardCapture(config, reporter, requestedAt) {
-  const InstrumentedCapture = PciVaultCardCapture;
-  return new InstrumentedCapture(config, { reporter, requestedAt });
-}
-
-// src/telemetry-bridge.ts
-var FLOPAY_TELEMETRY_BRIDGE = /* @__PURE__ */ Symbol.for("@flopay/js.telemetry.bridge.v1");
-function attachFloPayTelemetryBridge(target, reporter, fallbackNow) {
-  const now = () => reporter?.now() ?? fallbackNow();
-  const bridge = {
-    error: (input) => reporter?.error(input),
-    log: (input) => reporter?.log(input),
-    performance: (input) => reporter?.performance(input),
-    terminal: (input) => reporter?.terminal(input),
-    now,
-    elapsed: (startedAt) => Math.max(0, now() - startedAt),
-    setCheckoutContext: (context) => reporter?.setCheckoutContext(context),
-    beginCheckout: (context = {}) => reporter?.beginCheckout(context) ?? now(),
-    disable: () => reporter?.disable()
-  };
-  Object.defineProperty(target, FLOPAY_TELEMETRY_BRIDGE, {
-    configurable: false,
-    enumerable: false,
-    writable: false,
-    value: bridge
-  });
-}
-function getFloPayTelemetryBridge(target) {
-  return target[FLOPAY_TELEMETRY_BRIDGE];
-}
-
-// src/flopay.ts
-function isExpectedDecline(error) {
-  if (!error) return false;
-  const code = error.code?.toLowerCase() ?? "";
-  return Boolean(error.declineCode) || code.includes("declin");
-}
-function telemetryProvider(name) {
-  if (name === "stripe" || name === "paypal" || name === "pcivault") return name;
-  return "other";
-}
-var FloPay = class {
-  constructor(provider, config, telemetryReporter) {
-    this.currentElements = null;
-    this.provider = provider;
-    this.config = config;
-    this.telemetryReporter = telemetryReporter ?? new TelemetryReporter({
-      billingApiUrl: (0, import_shared6.resolveBillingApiUrl)(config.billingApiUrl),
-      sdkVersion: import_shared6.SDK_VERSION,
-      enabled: config.telemetry !== false
-    });
-    attachFloPayTelemetryBridge(this, this.telemetryReporter, telemetryNow);
-  }
-  now() {
-    return this.telemetryReporter?.now?.() ?? telemetryNow();
-  }
-  /**
-   * Creates a new `FloPayElements` group for mounting payment fields.
-   *
-   * Only one elements group is active at a time. Creating a new one
-   * destroys the previous group.
-   */
-  elements(options) {
-    if (this.currentElements) {
-      this.currentElements.destroy();
-    }
-    this.currentElements = new FloPayElements(this.provider, {
-      appearance: this.config.appearance,
-      ...options
-    });
-    return this.currentElements;
-  }
-  /** Submit elements for validation. */
-  async submitElements() {
-    return this.provider.submitElements();
-  }
-  /**
-   * Create a {@link CardCaptureAdapter} for collecting card details through the
-   * backend-rendered hosted vault PCI widget (TeamFloPay/backend#823).
-   *
-   * The returned adapter injects the server-supplied widget HTML (the session's
-   * {@link CheckoutSession.vault} block, or one fetched via
-   * `PaymentAPI.getVaultCapture`) and relays the widget's terminal outcome. The
-   * backend owns tokenization, the PaymentIntent, 3DS, and fulfilment — no
-   * Stripe.js is involved on the card path and PCI-sensitive fields never enter
-   * the SDK runtime.
-   */
-  cardCapture(options) {
-    const requestedAt = this.now();
-    this.telemetryReporter?.log({
-      name: "vault.capture.requested",
-      stage: "vault_request",
-      provider: "pcivault",
-      paymentMethodCategory: "card"
-    });
-    if (this.telemetryReporter) {
-      return createInstrumentedPciVaultCardCapture(
-        { sessionId: options?.sessionId },
-        this.telemetryReporter,
-        requestedAt
-      );
-    }
-    return new PciVaultCardCapture({
-      sessionId: options?.sessionId,
-      telemetry: false
-    });
-  }
-  /** Confirm a PayPal payment: create intent via billing API → confirm → redirect if needed. */
-  async confirmPayPalPayment(params) {
-    const startedAt = this.now();
-    this.telemetryReporter?.log({
-      name: "payment.method.selected",
-      stage: "processing",
-      provider: "paypal",
-      paymentMethodCategory: "paypal"
-    });
-    this.telemetryReporter?.log({
-      name: "payment.intent.started",
-      stage: "processing",
-      provider: "paypal",
-      paymentMethodCategory: "paypal",
-      requestCategory: "intent_create"
-    });
-    try {
-      const result = await this.provider.confirmPayPalPayment(params);
-      this.telemetryReporter?.performance({
-        stage: "processing",
-        durationMs: this.now() - startedAt,
-        durationMode: "machine",
-        provider: "paypal",
-        paymentMethodCategory: "paypal"
-      });
-      if (!result.error) {
-        this.telemetryReporter?.log({
-          name: "payment.intent.completed",
-          stage: "processing",
-          provider: "paypal",
-          paymentMethodCategory: "paypal",
-          requestCategory: "intent_create",
-          statusClass: "2xx"
-        });
-      }
-      if (result.status === "requires_action") {
-        this.telemetryReporter?.log({
-          name: "provider.redirect.started",
-          stage: "redirect",
-          provider: "paypal",
-          paymentMethodCategory: "paypal"
-        });
-        this.telemetryReporter?.terminal({
-          outcome: "action_required",
-          stage: "redirect",
-          provider: "paypal",
-          paymentMethodCategory: "paypal"
-        });
-      } else if (result.status === "succeeded") {
-        this.telemetryReporter?.terminal({
-          outcome: "payment_succeeded",
-          provider: "paypal",
-          paymentMethodCategory: "paypal"
-        });
-      } else if (result.status !== "processing") {
-        if (isExpectedDecline(result.error)) {
-          this.telemetryReporter?.terminal({
-            outcome: "payment_declined",
-            provider: "paypal",
-            paymentMethodCategory: "paypal"
-          });
-        } else if (result.error?.type === "validation_error") {
-          this.telemetryReporter?.terminal({
-            outcome: "validation_rejected",
-            provider: "paypal",
-            paymentMethodCategory: "paypal"
-          });
-        } else if (result.error) {
-          this.telemetryReporter?.error({
-            errorCode: "PAYMENT_PROCESSING_FAILED",
-            stage: "processing",
-            provider: "paypal",
-            paymentMethodCategory: "paypal",
-            requestCategory: "intent_create"
-          });
-        }
-      }
-      return result;
-    } catch (error) {
-      this.telemetryReporter?.performance({
-        stage: "processing",
-        durationMs: this.now() - startedAt,
-        durationMode: "machine",
-        provider: "paypal",
-        paymentMethodCategory: "paypal"
-      });
-      this.telemetryReporter?.error({
-        errorCode: "NETWORK_REQUEST_FAILED",
-        stage: "processing",
-        provider: "paypal",
-        paymentMethodCategory: "paypal",
-        requestCategory: "intent_create",
-        statusClass: "network_error"
-      });
-      throw error;
-    }
-  }
-  /** Resume a PayPal payment after redirect return. Returns null if no PayPal params in URL. */
-  async resumePayPalPayment() {
-    const startedAt = this.now();
-    try {
-      const result = await this.provider.resumePayPalPayment();
-      if (result === null) return null;
-      this.telemetryReporter?.log({
-        name: "provider.redirect.resumed",
-        stage: "redirect_resume",
-        provider: "paypal",
-        paymentMethodCategory: "paypal"
-      });
-      this.telemetryReporter?.performance({
-        stage: "redirect_resume",
-        durationMs: this.now() - startedAt,
-        durationMode: "machine",
-        provider: "paypal",
-        paymentMethodCategory: "paypal"
-      });
-      if (result.status === "succeeded") {
-        this.telemetryReporter?.terminal({
-          outcome: "payment_succeeded",
-          provider: "paypal",
-          paymentMethodCategory: "paypal"
-        });
-      } else if (isExpectedDecline(result.error)) {
-        this.telemetryReporter?.terminal({
-          outcome: "payment_declined",
-          provider: "paypal",
-          paymentMethodCategory: "paypal"
-        });
-      } else if (result.error?.type === "validation_error") {
-        this.telemetryReporter?.terminal({
-          outcome: "validation_rejected",
-          provider: "paypal",
-          paymentMethodCategory: "paypal"
-        });
-      } else if (result.error) {
-        this.telemetryReporter?.error({
-          errorCode: "REDIRECT_RESUME_FAILED",
-          stage: "redirect_resume",
-          provider: "paypal",
-          paymentMethodCategory: "paypal"
-        });
-      }
-      return result;
-    } catch (error) {
-      this.telemetryReporter?.performance({
-        stage: "redirect_resume",
-        durationMs: this.now() - startedAt,
-        durationMode: "machine",
-        provider: "paypal",
-        paymentMethodCategory: "paypal"
-      });
-      this.telemetryReporter?.error({
-        errorCode: "REDIRECT_RESUME_FAILED",
-        stage: "redirect_resume",
-        provider: "paypal",
-        paymentMethodCategory: "paypal"
-      });
-      throw error;
-    }
-  }
-  /** Confirms a non-card wallet/APM payment using the mounted PaymentElement. */
-  async confirmPayment(params) {
-    if (params.paymentMethodCategory !== "wallet" && params.paymentMethodCategory !== "apm" || !params.paymentMethodType?.trim() || params.paymentMethodType.trim().toLowerCase() === "card") {
-      throw new import_shared6.FloPayError(
-        "A supported non-card payment method is required.",
-        "validation_error",
-        { param: "paymentMethodType" }
-      );
-    }
-    const started = this.now();
-    const provider = telemetryProvider(this.provider.name);
-    this.telemetryReporter?.log({
-      name: "payment.processing.started",
-      stage: "processing",
-      provider,
-      paymentMethodCategory: params.paymentMethodCategory
-    });
-    try {
-      const result = await this.provider.confirmPayment(params);
-      const durationMs = this.now() - started;
-      this.telemetryReporter?.performance({
-        stage: "processing",
-        durationMs,
-        durationMode: "machine",
-        provider,
-        paymentMethodCategory: params.paymentMethodCategory
-      });
-      if (result.status === "succeeded") {
-        this.telemetryReporter?.terminal({
-          outcome: "payment_succeeded",
-          provider,
-          paymentMethodCategory: params.paymentMethodCategory
-        });
-      } else if (isExpectedDecline(result.error)) {
-        this.telemetryReporter?.terminal({
-          outcome: "payment_declined",
-          provider,
-          paymentMethodCategory: params.paymentMethodCategory
-        });
-      } else if (result.error?.type === "validation_error") {
-        this.telemetryReporter?.terminal({
-          outcome: "validation_rejected",
-          provider,
-          paymentMethodCategory: params.paymentMethodCategory
-        });
-      } else if (result.status === "requires_action") {
-        this.telemetryReporter?.terminal({
-          outcome: "action_required",
-          stage: "three_ds_handoff",
-          provider,
-          paymentMethodCategory: params.paymentMethodCategory
-        });
-      } else if (result.status === "failed" && result.error) {
-        this.telemetryReporter?.error({
-          errorCode: "PAYMENT_PROCESSING_FAILED",
-          stage: "processing",
-          provider,
-          paymentMethodCategory: params.paymentMethodCategory
-        });
-      }
-      if (result.status === "succeeded" || result.status === "failed") {
-        this.telemetryReporter?.log({
-          name: "payment.processing.completed",
-          stage: "processing",
-          provider,
-          paymentMethodCategory: params.paymentMethodCategory
-        });
-      } else {
-        this.telemetryReporter?.log({
-          name: "operation.state_transition",
-          stage: result.status === "requires_action" ? "three_ds_handoff" : "processing",
-          provider,
-          paymentMethodCategory: params.paymentMethodCategory
-        });
-      }
-      return result;
-    } catch (error) {
-      this.telemetryReporter?.performance({
-        stage: "processing",
-        durationMs: this.now() - started,
-        durationMode: "machine",
-        provider,
-        paymentMethodCategory: params.paymentMethodCategory
-      });
-      this.telemetryReporter?.error({
-        errorCode: "PAYMENT_PROCESSING_FAILED",
-        stage: "processing",
-        provider,
-        paymentMethodCategory: params.paymentMethodCategory
-      });
-      throw error;
-    }
-  }
-  /**
-   * Retrieves a checkout session by ID via the billing API.
-   *
-   * Returns the normalized `CheckoutSession` with amount, currency,
-   * customer data, and status.
-   *
-   * Requires `billingApiUrl` to be set — either via `loadFloPay(key, { billingApiUrl })`
-   * or passed directly as the second argument.
-   */
-  async retrieveSession(sessionId, billingApiUrl) {
-    if (!sessionId) {
-      throw new import_shared6.FloPayError(
-        "sessionId is required to retrieve a session.",
-        "validation_error",
-        { param: "sessionId" }
-      );
-    }
-    const unified = await this.retrieveUnifiedSession(sessionId, billingApiUrl);
-    if (!unified.data.session) {
-      throw new import_shared6.FloPayError("Session not found", "api_error");
-    }
-    return unified.data.session;
-  }
-  /**
-   * Retrieves and normalizes a checkout session, including provider-specific
-   * data (Stripe clientSecret/publishableKey, Chargebee site, etc.).
-   *
-   * The billing API URL is resolved from: explicit param → `loadFloPay()` config
-   * → `NEXT_PUBLIC_FLOPAY_ENV` env var → `configureFlopay()` → staging fallback.
-   */
-  async retrieveUnifiedSession(sessionId, billingApiUrl) {
-    if (!sessionId) {
-      throw new import_shared6.FloPayError(
-        "sessionId is required.",
-        "validation_error",
-        { param: "sessionId" }
-      );
-    }
-    const apiUrl = (0, import_shared6.resolveBillingApiUrl)(billingApiUrl ?? this.config.billingApiUrl);
-    const started = this.now();
-    this.telemetryReporter?.log({
-      name: "session.read.started",
-      stage: "session_read",
-      requestCategory: "session_read"
-    });
-    let firstByteDuration;
-    const api = createInstrumentedPaymentAPI(apiUrl, {
-      now: () => this.telemetryReporter?.now() ?? telemetryNow(),
-      onFirstByte: (durationMs) => {
-        firstByteDuration = durationMs;
-      },
-      onRetry: (requestCategory, attempt) => {
-        this.telemetryReporter?.log({
-          name: "operation.retry",
-          stage: requestCategory === "session_read" ? "session_read" : "processing",
-          requestCategory,
-          attempt
-        });
-      }
-    });
-    try {
-      const result = await api.getUnifiedCheckoutSession(sessionId);
-      if (firstByteDuration !== void 0) {
-        this.telemetryReporter?.log({
-          name: "session.request.first_byte",
-          stage: "session_first_byte",
-          requestCategory: "session_read",
-          statusClass: "2xx"
-        });
-        this.telemetryReporter?.performance({
-          stage: "session_first_byte",
-          durationMs: firstByteDuration,
-          durationMode: "machine",
-          requestCategory: "session_read",
-          statusClass: "2xx"
-        });
-      }
-      this.telemetryReporter?.log({
-        name: "session.request.completed",
-        stage: "session_complete",
-        requestCategory: "session_read",
-        statusClass: "2xx"
-      });
-      this.telemetryReporter?.log({
-        name: "checkout.data.ready",
-        stage: "checkout_data_ready"
-      });
-      this.telemetryReporter?.performance({
-        stage: "session_complete",
-        durationMs: this.now() - started,
-        durationMode: "machine",
-        requestCategory: "session_read",
-        statusClass: "2xx"
-      });
-      return result;
-    } catch (error) {
-      const statusCode = error instanceof import_shared6.FloPayError ? error.statusCode : void 0;
-      this.telemetryReporter?.error({
-        errorCode: error instanceof import_shared6.FloPayError && error.code === "checkout_processing_timeout" ? "REQUEST_TIMEOUT" : "NETWORK_REQUEST_FAILED",
-        stage: "session_read",
-        provider: "flo",
-        paymentMethodCategory: "unknown"
-      });
-      this.telemetryReporter?.performance({
-        stage: "session_complete",
-        durationMs: this.now() - started,
-        durationMode: "machine",
-        requestCategory: "session_read",
-        statusClass: statusCode ? `${Math.floor(statusCode / 100)}xx` : "network_error"
-      });
-      throw error;
-    }
-  }
-  /**
-   * Returns the raw underlying provider instance (e.g. Stripe object).
-   * Used internally by components that need direct provider access,
-   * such as PayPal which requires its own Elements instance.
-   */
-  getRawProvider() {
-    return this.provider.getRawProvider();
-  }
-  /** Tears down the SDK instance and releases resources. */
-  destroy() {
-    this.telemetryReporter?.log({ name: "checkout.unmount", stage: "unmount" });
-    this.telemetryReporter?.destroy();
-    this.currentElements?.destroy();
-    this.currentElements = null;
-    this.provider.destroy();
-  }
-};
-function createInstrumentedFloPay(provider, config, reporter) {
-  const InstrumentedFloPay = FloPay;
-  return new InstrumentedFloPay(provider, config, reporter);
-}
-
-// src/load.ts
-var instanceCache = /* @__PURE__ */ new Map();
-function stableCacheValue(value) {
-  if (Array.isArray(value)) return value.map(stableCacheValue);
-  if (value && typeof value === "object") {
-    return Object.fromEntries(
-      Object.entries(value).filter(([, entry]) => entry !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => [key, stableCacheValue(entry)])
-    );
-  }
-  return value;
-}
-function instanceCacheKey(publishableKey, options) {
-  return JSON.stringify([
-    publishableKey,
-    (0, import_shared7.resolveBillingApiUrl)(options?.billingApiUrl),
-    options?.telemetry !== false,
-    options?.locale ?? "auto",
-    options?.apiVersion ?? null,
-    stableCacheValue(options?.appearance ?? null)
-  ]);
-}
-var initializationCache = /* @__PURE__ */ new Map();
-async function loadFloPay(publishableKey, options) {
-  if (!publishableKey) {
-    const reporter = new TelemetryReporter({
-      billingApiUrl: (0, import_shared7.resolveBillingApiUrl)(options?.billingApiUrl),
-      sdkVersion: import_shared7.SDK_VERSION,
-      enabled: options?.telemetry !== false
-    });
-    reporter.error({
-      errorCode: "CONFIGURATION_INVALID",
-      stage: "sdk_initialize",
-      paymentMethodCategory: "unknown"
-    });
-    void reporter.flush().catch(() => {
-    }).finally(() => reporter.destroy());
-    throw new import_shared7.FloPayError(
-      "A publishable key is required to initialize FloPay.",
-      "validation_error",
-      { param: "publishableKey" }
-    );
-  }
-  const cacheKey = instanceCacheKey(publishableKey, options);
-  const cached = instanceCache.get(cacheKey);
-  if (cached) {
-    if (options?.telemetry !== false) {
-      getFloPayTelemetryBridge(cached)?.log({
-        name: "sdk.cache.hit",
-        stage: "sdk_initialize"
-      });
-    }
-    return cached;
-  }
-  const initializing = initializationCache.get(cacheKey);
-  if (initializing) return initializing;
-  const config = {
-    ...options,
-    publishableKey
-  };
-  const initialization = (async () => {
-    const reporter = new TelemetryReporter({
-      billingApiUrl: (0, import_shared7.resolveBillingApiUrl)(config.billingApiUrl),
-      sdkVersion: import_shared7.SDK_VERSION,
-      enabled: config.telemetry !== false
-    });
-    const initializationStarted = reporter.now();
-    reporter.log({ name: "sdk.initialize.started", stage: "sdk_initialize" });
-    reporter.log({ name: "sdk.cache.miss", stage: "sdk_initialize" });
-    reporter.log({
-      name: "provider.load.started",
-      stage: "provider_load",
-      provider: "stripe"
-    });
-    const adapter = new StripeAdapter();
-    try {
-      await adapter.initialize(config);
-    } catch (error) {
-      reporter.error({
-        errorCode: "SDK_INITIALIZATION_FAILED",
-        stage: "sdk_initialize",
-        provider: "stripe",
-        paymentMethodCategory: "unknown"
-      });
-      reporter.destroy();
-      throw error;
-    }
-    reporter.log({ name: "provider.ready", stage: "provider_ready", provider: "stripe" });
-    reporter.log({
-      name: "provider.availability.checked",
-      stage: "provider_ready",
-      provider: "stripe"
-    });
-    reporter.log({ name: "sdk.initialize.ready", stage: "sdk_initialize" });
-    const initializationDuration = reporter.now() - initializationStarted;
-    reporter.performance({
-      stage: "sdk_initialize",
-      durationMs: initializationDuration,
-      durationMode: "machine",
-      provider: "stripe"
-    });
-    reporter.performance({
-      stage: "provider_ready",
-      durationMs: initializationDuration,
-      durationMode: "machine",
-      provider: "stripe"
-    });
-    const instance = createInstrumentedFloPay(adapter, config, reporter);
-    instanceCache.set(cacheKey, instance);
-    return instance;
-  })();
-  initializationCache.set(cacheKey, initialization);
-  try {
-    return await initialization;
-  } finally {
-    if (initializationCache.get(cacheKey) === initialization) {
-      initializationCache.delete(cacheKey);
-    }
-  }
-}
-
-// src/create-checkout-session.ts
-var import_shared8 = require("@flopay/shared");
-var MAX_COUPON_CODES = 5;
-function buildCheckoutSessionError(status, payload) {
-  const nested = payload?.error;
-  const code = readErrorString(payload?.code) ?? readErrorString(nested?.code) ?? `http_${status}`;
-  const message = readErrorString(payload?.message) ?? readErrorString(nested?.message) ?? defaultMessageForCode(code, status);
-  return new import_shared8.FloPayError(message, "api_error", { code, statusCode: status });
-}
-function defaultMessageForCode(code, status) {
-  switch (code) {
-    case "CouponLimitExceeded":
-      return `Too many coupon codes \u2014 a checkout session accepts at most ${MAX_COUPON_CODES}.`;
-    case "CouponCurrencyUnsupported":
-      return "One of the applied coupons has no price configured for the cart currency.";
-    default:
-      return `Failed to create checkout session (HTTP ${status}).`;
-  }
-}
-async function createCheckoutSessionCore(options, onFirstByte) {
-  const {
-    billingApiUrl,
-    checkoutBaseUrl,
-    items = [],
-    subscriptions = [],
-    products,
-    account,
-    successUrl,
-    cancelUrl,
-    checkoutMode = "confirm",
-    couponCodes = [],
-    tagsData,
-    redirectParams = {},
-    setCookie = true,
-    timeoutMs = 12e3,
-    clientId,
-    currency,
-    utmMetadata,
-    idempotencyKey
-  } = options;
-  const resolvedIdempotencyKey = (0, import_shared8.resolveIdempotencyKey)(idempotencyKey);
-  if (couponCodes.length > MAX_COUPON_CODES) {
-    throw new import_shared8.FloPayError(
-      `Too many coupon codes \u2014 a checkout session accepts at most ${MAX_COUPON_CODES}.`,
-      "validation_error",
-      { code: "CouponLimitExceeded", param: "couponCodes" }
-    );
-  }
-  const wireProducts = products ?? (0, import_shared8.foldIntoProducts)(items, subscriptions);
-  const sessionCurrency = (0, import_shared8.resolveSessionCurrency)(currency, items, subscriptions, wireProducts);
-  if (!sessionCurrency) {
-    throw new import_shared8.FloPayError(
-      "currency is required: pass `currency` on the session, or include a `currency` on the first item/subscription/product.",
-      "validation_error",
-      { code: "CurrencyRequired", param: "currency" }
-    );
-  }
-  const payload = {
-    clientId,
-    checkoutVersion: import_shared8.SDK_VERSION,
-    successUrl,
-    cancelUrl,
-    currency: sessionCurrency,
-    checkoutMode,
-    products: wireProducts.map((product) => (0, import_shared8.buildProductPayload)(product, sessionCurrency)),
-    accountData: {
-      userId: account.userId,
-      firstName: account.firstName ?? null,
-      lastName: account.lastName ?? null,
-      email: account.email,
-      country: account.country ?? null,
-      gender: account.gender ?? null,
-      city: account.city ?? null,
-      state: account.state ?? null,
-      zip: account.zip ?? null,
-      addressLine1: account.addressLine1 ?? null,
-      addressLine2: account.addressLine2 ?? null
-    },
-    couponCodes
-  };
-  if (tagsData) {
-    payload["tagsData"] = tagsData;
-  }
-  if (utmMetadata?.length) {
-    payload["utmMetadata"] = utmMetadata;
-  }
-  const url = `${billingApiUrl.replace(/\/+$/, "")}/v1/checkouts/sessions`;
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  const headers = { "Content-Type": "application/json" };
-  if (resolvedIdempotencyKey) {
-    headers[import_shared8.IDEMPOTENCY_KEY_HEADER] = resolvedIdempotencyKey;
-  }
-  let status;
-  let body;
-  try {
-    const response = await fetch(url, {
-      method: "POST",
-      headers,
-      body: JSON.stringify(payload),
-      signal: controller.signal
-    });
-    try {
-      onFirstByte?.(response.status);
-    } catch {
-    }
-    status = response.status;
-    try {
-      body = await response.json();
-    } catch {
-    }
-  } finally {
-    clearTimeout(timer);
-  }
-  if (status >= 400) {
-    throw buildCheckoutSessionError(status, body);
-  }
-  if (status === 201) {
-    const uuid = body?.data?.uuid;
-    const nonce = body?.data?.nonce;
-    if (!uuid) {
-      throw new Error("Checkout session created but no UUID was returned by the billing API");
-    }
-    if (!nonce) {
-      throw new import_shared8.FloPayError(
-        "Checkout session created but no `nonce` was returned by the billing API. Upgrade the billing service to TeamFloPay/backend#640 or later.",
-        "api_error",
-        { code: "MissingCheckoutSessionToken" }
-      );
-    }
-    if (wireProducts.length || sessionCurrency) {
-      cacheSessionDisplayData(uuid, {
-        currency: sessionCurrency,
-        products: wireProducts.map((p) => ({
-          code: p.code ?? p.providerItemId ?? p.providerPlanId,
-          type: p.type,
-          name: p.name ?? p.itemName ?? p.providerItemName ?? p.subscriptionName ?? p.providerPlanName ?? null,
-          totalAmount: p.totalAmount,
-          overrideAmount: p.overrideAmount,
-          currency: p.currency ?? sessionCurrency
-        }))
-      });
-    }
-    const redirectUrl = new URL(`${checkoutBaseUrl.replace(/\/+$/, "")}/secure`);
-    redirectUrl.searchParams.set("id", uuid);
-    for (const [key, value] of Object.entries(redirectParams)) {
-      redirectUrl.searchParams.set(key, value);
-    }
-    if (setCookie && typeof window !== "undefined" && typeof document !== "undefined") {
-      const checkoutData = JSON.stringify({ origin_url: cancelUrl });
-      const domain = window.location.hostname.split(".").slice(-2).join(".");
-      document.cookie = `checkout_data=${encodeURIComponent(checkoutData)}; domain=.${domain}; path=/; max-age=3600; SameSite=Lax; Secure;`;
-      document.cookie = `flopay_checkout_token=${encodeURIComponent(nonce)}; domain=.${domain}; path=/; max-age=3600; SameSite=Lax; Secure;`;
-    }
-    if (typeof window !== "undefined") {
-      window.location.href = redirectUrl.toString();
-    }
-    return { status: 201, redirectUrl: redirectUrl.toString(), nonce };
-  }
-  if (status === 204) {
-    if (typeof window !== "undefined") {
-      window.location.href = successUrl;
-    }
-    return { status: 204 };
-  }
-  return { status };
-}
-async function createCheckoutSession(options) {
-  const telemetry = beginCreateSessionTelemetry(options);
-  const recordFirstByte = createFirstByteRecorder(telemetry);
-  try {
-    const result = await createCheckoutSessionCore(options, recordFirstByte);
-    completeCreateSessionTelemetry(telemetry, result);
-    return result;
-  } catch (error) {
-    failCreateSessionTelemetry(telemetry.reporter, error);
-    throw error;
-  } finally {
-    finishCreateSessionTelemetry(telemetry.reporter);
-  }
-}
-function createFirstByteRecorder(telemetry) {
-  let recorded = false;
-  return (status) => {
-    if (recorded) return;
-    recorded = true;
-    const statusClass = `${Math.floor(status / 100)}xx`;
-    telemetry.reporter.log({
-      name: "session.request.first_byte",
-      stage: "session_first_byte",
-      requestCategory: "session_create",
-      statusClass
-    });
-    telemetry.reporter.performance({
-      stage: "session_first_byte",
-      durationMs: telemetry.reporter.now() - telemetry.startedAt,
-      durationMode: "machine",
-      requestCategory: "session_create",
-      statusClass
-    });
-  };
-}
-function beginCreateSessionTelemetry(options) {
-  const reporter = new TelemetryReporter({
-    billingApiUrl: options.billingApiUrl,
-    sdkVersion: import_shared8.SDK_VERSION,
-    enabled: options.telemetry !== false
-  });
-  const startedAt = reporter.now();
-  reporter.log({
-    name: "session.create.started",
-    stage: "session_create",
-    requestCategory: "session_create"
-  });
-  return { reporter, startedAt };
-}
-function completeCreateSessionTelemetry(telemetry, result) {
-  const statusClass = `${Math.floor(result.status / 100)}xx`;
-  telemetry.reporter.log({
-    name: "session.request.completed",
-    stage: "session_complete",
-    requestCategory: "session_create",
-    statusClass
-  });
-  telemetry.reporter.performance({
-    stage: "session_complete",
-    durationMs: telemetry.reporter.now() - telemetry.startedAt,
-    durationMode: "machine",
-    requestCategory: "session_create",
-    statusClass
-  });
-}
-function failCreateSessionTelemetry(reporter, error) {
-  if (error instanceof import_shared8.FloPayError && error.type === "validation_error") {
-    reporter.terminal({
-      outcome: "validation_rejected",
-      stage: "session_create",
-      requestCategory: "session_create"
-    });
-    return;
-  }
-  const statusCode = error instanceof import_shared8.FloPayError ? error.statusCode : void 0;
-  reporter.error({
-    errorCode: error instanceof Error && error.name === "AbortError" ? "REQUEST_TIMEOUT" : error instanceof TypeError ? "NETWORK_REQUEST_FAILED" : "CHECKOUT_SESSION_CREATE_FAILED",
-    stage: "session_create",
-    requestCategory: "session_create",
-    statusClass: error instanceof Error && error.name === "AbortError" ? "timeout" : statusCode ? `${Math.floor(statusCode / 100)}xx` : "network_error"
-  });
-}
-function finishCreateSessionTelemetry(reporter) {
-  void reporter.flush().catch(() => {
-  }).finally(() => reporter.destroy());
-}
-async function createCheckoutSessionWithRetries(options) {
-  const { maxRetries = 3, ...sessionOptions } = options;
-  const telemetry = beginCreateSessionTelemetry(options);
-  const recordFirstByte = createFirstByteRecorder(telemetry);
-  if (!Number.isFinite(maxRetries) || !Number.isInteger(maxRetries) || maxRetries <= 0) {
-    telemetry.reporter.terminal({
-      outcome: "validation_rejected",
-      stage: "session_create",
-      requestCategory: "session_create"
-    });
-    finishCreateSessionTelemetry(telemetry.reporter);
-    throw new Error("Number of retries must be greater than 0");
-  }
-  const attemptOptions = {
-    ...sessionOptions,
-    idempotencyKey: (0, import_shared8.resolveIdempotencyKey)(sessionOptions.idempotencyKey)
-  };
-  let lastErr;
-  for (let attempt = 0; attempt <= maxRetries; attempt++) {
-    try {
-      const result = await createCheckoutSessionCore(attemptOptions, recordFirstByte);
-      completeCreateSessionTelemetry(telemetry, result);
-      finishCreateSessionTelemetry(telemetry.reporter);
-      return result;
-    } catch (err) {
-      lastErr = err;
-      const isTransportAbort = err instanceof Error && err.name === "AbortError";
-      const isInProgressReplay = err instanceof import_shared8.FloPayError && err.code === import_shared8.IDEMPOTENCY_IN_PROGRESS_CODE;
-      if ((isTransportAbort || isInProgressReplay) && attempt < maxRetries) {
-        telemetry.reporter.log({
-          name: "operation.retry",
-          stage: "session_create",
-          requestCategory: "session_create",
-          attempt: attempt + 1
-        });
-        await new Promise((r) => setTimeout(r, 100 * Math.pow(2, attempt)));
-        continue;
-      }
-      failCreateSessionTelemetry(telemetry.reporter, err);
-      finishCreateSessionTelemetry(telemetry.reporter);
-      throw err;
-    }
-  }
-  failCreateSessionTelemetry(telemetry.reporter, lastErr);
-  finishCreateSessionTelemetry(telemetry.reporter);
-  throw lastErr ?? new Error("Unknown error during checkout session creation");
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  FloPay,
-  FloPayElements,
-  PaymentAPI,
-  PciVaultCardCapture,
-  StripeAdapter,
-  cacheSessionDisplayData,
-  clearSessionDisplayData,
-  createCheckoutSession,
-  createCheckoutSessionWithRetries,
-  getSessionDisplayData,
-  loadFloPay
-});
-//# sourceMappingURL=index.cjs.map
+"use strict";var le=Object.defineProperty;var We=Object.getOwnPropertyDescriptor;var Qe=Object.getOwnPropertyNames;var Je=Object.prototype.hasOwnProperty;var Xe=(n,e)=>{for(var t in e)le(n,t,{get:e[t],enumerable:!0})},Ze=(n,e,t,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let s of Qe(e))!Je.call(n,s)&&s!==t&&le(n,s,{get:()=>e[s],enumerable:!(r=We(e,s))||r.enumerable});return n};var et=n=>Ze(le({},"__esModule",{value:!0}),n);var Rt={};Xe(Rt,{FloPay:()=>G,FloPayElements:()=>B,PaymentAPI:()=>A,PciVaultCardCapture:()=>F,StripeAdapter:()=>K,cacheSessionDisplayData:()=>x,clearSessionDisplayData:()=>te,createCheckoutSession:()=>ze,createCheckoutSessionWithRetries:()=>Ge,getSessionDisplayData:()=>ee,loadFloPay:()=>Ke});module.exports=et(Rt);var R=require("@flopay/shared");var Ie=require("@stripe/stripe-js"),h=require("@flopay/shared");var d=require("@flopay/shared");function I(n){return typeof n=="string"&&n.trim()?n:void 0}function _e(n){if(typeof n=="string")return n.trim()?n:void 0;if(Array.isArray(n))return n.filter(t=>typeof t=="string"&&t.trim().length>0).join("; ")||void 0}var tt="flopay_session_display:";var X=new Map;function Z(n){return`${tt}${n}`}function ce(){if(typeof window>"u")return null;try{return window.sessionStorage}catch{return null}}function x(n,e,t){if(!n)return;let r=t?.ttlMs??36e5,s={data:e,expiresAt:Date.now()+r},o=ce();if(o)try{o.setItem(Z(n),JSON.stringify(s));return}catch{}X.set(n,s)}function ee(n){if(!n)return null;let e=ce();if(e)try{let r=e.getItem(Z(n));if(r){let s=JSON.parse(r);if(s&&typeof s.expiresAt=="number"&&s.expiresAt>Date.now())return s.data;e.removeItem(Z(n))}}catch{}let t=X.get(n);if(t){if(t.expiresAt>Date.now())return t.data;X.delete(n)}return null}function te(n){if(!n)return;X.delete(n);let e=ce();if(e)try{e.removeItem(Z(n))}catch{}}var T=require("@flopay/shared"),rt="/v1/sdk-telemetry/events",de=16,nt=64,ot=1500,we=1e3,st=64,it="00000000-0000-4000-8000-000000000000",at={technical_error:8,lifecycle:32,expected_outcome:32,performance:24};function L(){try{return globalThis.crypto.randomUUID()}catch{let n=new Uint8Array(16);try{globalThis.crypto.getRandomValues(n)}catch{for(let t=0;t<n.length;t+=1)n[t]=Math.floor(Math.random()*256)}n[6]=n[6]&15|64,n[8]=n[8]&63|128;let e=[...n].map(t=>t.toString(16).padStart(2,"0")).join("");return`${e.slice(0,8)}-${e.slice(8,12)}-${e.slice(12,16)}-${e.slice(16,20)}-${e.slice(20)}`}}function lt(n){try{return new TextEncoder().encode(n).byteLength}catch{return n.length}}function ct(n){return JSON.stringify([n.code,n.stage,n.provider,n.attempt,n.statusClass,n.requestCategory,n.paymentMethodCategory,n.checkoutMode,n.layout])}function _(){return globalThis.performance?.now()??0}var v=class{constructor(e){this.ingestionDisabled=!1;this.queue=[];this.sequence=0;this.flushTimer=null;this.flushInFlight=null;this.reportedFailures=new Map;this.checkoutContext={};this.checkoutStartedAt=null;this.destroyed=!1;this.pageExitHandler=()=>{this.drainQueue()};this.visibilityHandler=()=>{document.visibilityState==="hidden"&&this.flush()};this.eventCounts={technical_error:0,lifecycle:0,expected_outcome:0,performance:0};this.endpoint=`${e.billingApiUrl.replace(/\/+$/,"")}${rt}`,this.sdkPackage=e.sdkPackage??"@flopay/js",this.sdkVersion=e.sdkVersion,this.correlationId=L(),this.merchantEnabled=e.enabled!==!1,this.clock=e.clock??_,this.browserTransportAvailable=typeof window<"u"&&typeof document<"u",this.browserTransportAvailable&&(window.addEventListener("pagehide",this.pageExitHandler),document.addEventListener("visibilitychange",this.visibilityHandler))}log(e){this.canCollect()&&this.enqueue((0,T.buildTelemetryLogEvent)({...this.checkoutContext,...e,eventId:L(),sequence:this.sequence++}))}error(e){if(!this.canCollect())return;let t=(0,T.buildTelemetryErrorEvent)({...this.checkoutContext,...e,eventId:it,sequence:0}),r=ct(t),s=this.now();this.pruneReportedFailures(s);let o=this.reportedFailures.get(r);if(o!==void 0&&s>=o&&s-o<we){this.log({name:"operation.deduplicated",stage:e.stage,provider:e.provider,paymentMethodCategory:e.paymentMethodCategory,attempt:e.attempt});return}this.rememberReportedFailure(r,s),this.enqueue((0,T.buildTelemetryErrorEvent)({...this.checkoutContext,...e,eventId:L(),sequence:this.sequence++}))}performance(e){this.canCollect()&&this.enqueue((0,T.buildTelemetryPerformanceEvent)({...this.checkoutContext,...e,eventId:L(),sequence:this.sequence++}))}terminal(e){if(this.canCollect()&&(this.enqueue((0,T.buildTelemetryTerminalEvent)({...this.checkoutContext,...e,eventId:L(),sequence:this.sequence++})),e.outcome!=="action_required"&&this.checkoutStartedAt!==null)){let t=this.checkoutStartedAt;this.checkoutStartedAt=null,this.performance({stage:"total_journey",durationMs:Math.max(0,this.now()-t),durationMode:"total",provider:e.provider,paymentMethodCategory:e.paymentMethodCategory})}}now(){try{return this.clock()}catch{return _()}}pruneReportedFailures(e){for(let[t,r]of this.reportedFailures)(e<r||e-r>=we)&&this.reportedFailures.delete(t)}rememberReportedFailure(e,t){for(;this.reportedFailures.size>=st;){let r=this.reportedFailures.keys().next();if(r.done)break;this.reportedFailures.delete(r.value)}this.reportedFailures.set(e,t)}setCheckoutContext(e){this.checkoutContext={checkoutMode:e.checkoutMode,layout:e.layout}}beginCheckout(e={}){return this.canCollect()?(this.drainQueue(),this.setCheckoutContext(e),this.sequence=0,this.reportedFailures.clear(),this.eventCounts={technical_error:0,lifecycle:0,expected_outcome:0,performance:0},this.checkoutStartedAt=this.now(),this.checkoutStartedAt):0}enqueue(e){if(this.canCollect()&&!(this.queue.length>=nt||this.eventCounts[e.class]>=at[e.class])){if(this.eventCounts[e.class]+=1,this.queue.push(e),this.queue.length>=de){this.flush();return}this.scheduleFlush()}}canCollect(){return this.browserTransportAvailable&&this.merchantEnabled&&!this.ingestionDisabled&&!this.destroyed}async flush(){if(this.flushInFlight)return this.flushInFlight;if(!this.browserTransportAvailable||this.destroyed||this.ingestionDisabled||this.queue.length===0)return;this.clearFlushTimer();let e=this.queue.splice(0,de);return this.flushInFlight=this.sendBatch(e).finally(()=>{this.flushInFlight=null,this.queue.length>0&&this.scheduleFlush()}),this.flushInFlight}destroy(){this.destroyed||(this.drainQueue(),this.destroyed=!0,this.clearFlushTimer(),this.browserTransportAvailable&&(window.removeEventListener("pagehide",this.pageExitHandler),document.removeEventListener("visibilitychange",this.visibilityHandler)),this.queue.splice(0),this.reportedFailures.clear())}disable(){this.merchantEnabled=!1,this.queue.splice(0),this.reportedFailures.clear(),this.clearFlushTimer()}drainQueue(){if(!(!this.browserTransportAvailable||this.destroyed||this.ingestionDisabled||this.queue.length===0))for(this.clearFlushTimer();this.queue.length>0;){let e=this.queue.splice(0,de);this.sendBatch(e)}}async sendBatch(e){if(!this.browserTransportAvailable||this.ingestionDisabled)return;let t=(0,T.serializeTelemetryBatch)(e,{correlationId:this.correlationId,sdkPackage:this.sdkPackage,sdkVersion:this.sdkVersion,batchId:L()});if(lt(t)>T.TELEMETRY_MAX_BATCH_BYTES)return;let r=typeof AbortController>"u"?null:new AbortController,s=null;try{let o=fetch(this.endpoint,{method:"POST",headers:{"content-type":"text/plain;charset=UTF-8"},body:t,credentials:"omit",keepalive:!0,referrerPolicy:"no-referrer",signal:r?.signal}).then(async l=>l.status!==202?null:(await l.json().catch(()=>null))?.status==="disabled"?"disabled":null).catch(()=>null),i=new Promise(l=>{s=setTimeout(()=>{r?.abort(),l(null)},ot)});await Promise.race([o,i])==="disabled"&&this.disableFromIngestion()}catch{}finally{s&&clearTimeout(s)}}disableFromIngestion(){this.ingestionDisabled=!0,this.queue.splice(0),this.reportedFailures.clear(),this.clearFlushTimer()}scheduleFlush(){this.flushTimer||this.destroyed||this.ingestionDisabled||(this.flushTimer=setTimeout(()=>{this.flushTimer=null,this.flush()},0))}clearFlushTimer(){this.flushTimer&&(clearTimeout(this.flushTimer),this.flushTimer=null)}},Pe=Symbol.for("@flopay/js.telemetry.reporter-factory.v1"),be=globalThis;be[Pe]===void 0&&Object.defineProperty(be,Pe,{configurable:!0,enumerable:!1,writable:!1,value:n=>new v(n)});var Ee=1e3,dt=500,ut=15e3,pt=3e3,mt=1e4;function yt(n){return typeof n=="object"&&n!==null}function D(n){if(n===void 0)return"network_error";let e=`${Math.floor(n/100)}xx`;return e==="2xx"||e==="3xx"||e==="4xx"||e==="5xx"?e:"unknown"}function ht(n,e){return n instanceof Error&&(n.name==="AbortError"||n instanceof d.FloPayError&&n.code==="checkout_processing_timeout")?{errorCode:"REQUEST_TIMEOUT",statusClass:"timeout"}:n instanceof TypeError?{errorCode:"NETWORK_REQUEST_FAILED",statusClass:"network_error"}:{errorCode:e,statusClass:D(n instanceof d.FloPayError?n.statusCode:void 0)}}function V(n,e){return I(n?.[e])}function ke(n,e){return _e(n?.[e])}function gt(n,e){let t=n?.[e];return typeof t=="number"&&Number.isFinite(t)?t:void 0}function ue(n){return new Promise(e=>setTimeout(e,n))}function re(){return new d.FloPayError("Checkout is still processing. Please try again shortly.","api_error",{code:"checkout_processing_timeout"})}async function N(n,e){let t=await n.json().catch(()=>null),r=yt(t?.error)?t.error:null,s=ke(t,"message")??ke(r,"message")??e,o=V(t,"code")??V(t,"gatewayErrorCode")??V(r,"code")??`http_${n.status}`;return new d.FloPayError(s,"api_error",{code:o,statusCode:n.status})}var H=2,ft=2;async function ne(n,e,t=H,r){let s;for(let o=0;;o++)try{return await fetch(n,e)}catch(i){if(i instanceof Error&&i.name==="AbortError")throw i;if(s=i,o>=t)throw s;try{r?.(o+1)}catch{}await ue(150*2**o)}}function Ct(n){return"now"in n||"onFirstByte"in n||"onSessionCreateFailure"in n||"onRetry"in n}var A=class{constructor(e,t={}){this.baseUrl=e.replace(/\/+$/,"");let r=Ct(t);this.telemetryHooks=r?t:void 0,this.directTelemetry=r||t.telemetry===!1?void 0:new v({billingApiUrl:this.baseUrl,sdkVersion:d.SDK_VERSION})}destroy(){this.directTelemetry?.destroy()}reportDirectFailure(e,t,r,s,o="unknown"){let i=ht(e,t);this.directTelemetry?.error({...i,stage:r,requestCategory:s,paymentMethodCategory:o})}telemetryTimestamp(){try{return this.telemetryHooks?.now?.()??this.directTelemetry?.now()??_()}catch{return _()}}beginDirectTelemetryCheckout(e){!this.directTelemetry||this.directTelemetryCheckoutId===e||(this.directTelemetryCheckoutId=e,this.directTelemetry.beginCheckout())}beginDirectTelemetryOperation(){this.directTelemetry&&(this.directTelemetryCheckoutId=void 0,this.directTelemetry.beginCheckout())}adoptDirectTelemetryCheckout(e){e&&(this.directTelemetryCheckoutId=e)}async getCheckoutSession(e,t){this.beginDirectTelemetryCheckout(e);let r=this.telemetryTimestamp();this.directTelemetry?.log({name:"session.read.started",stage:"session_read",requestCategory:"session_read"});let s={[d.FLO_SDK_VERSION_HEADER]:d.SDK_VERSION};t&&(s["x-checkout-session-token"]=t);try{let o=await ne(`${this.baseUrl}/v1/checkouts/sessions/${encodeURIComponent(e)}`,{headers:s},H,c=>{this.telemetryHooks?.onRetry?.("session_read",c),this.directTelemetry?.log({name:"operation.retry",stage:"session_read",requestCategory:"session_read",attempt:c})}),i=Math.max(0,this.telemetryTimestamp()-r);try{this.telemetryHooks?.onFirstByte?.(i)}catch{}let a=`${Math.floor(o.status/100)}xx`;if(this.directTelemetry?.log({name:"session.request.first_byte",stage:"session_first_byte",requestCategory:"session_read",statusClass:a}),this.directTelemetry?.performance({stage:"session_first_byte",durationMs:i,durationMode:"machine",requestCategory:"session_read",statusClass:a}),!o.ok)throw await N(o,"Failed to get checkout session");let l=await o.json();return this.directTelemetry?.log({name:"session.request.completed",stage:"session_complete",requestCategory:"session_read",statusClass:a}),this.directTelemetry?.performance({stage:"session_complete",durationMs:Math.max(0,this.telemetryTimestamp()-r),durationMode:"machine",requestCategory:"session_read",statusClass:a}),{...l,data:this.mergeCachedDisplayData(l.data)}}catch(o){let i=o instanceof d.FloPayError?o.statusCode:void 0;throw this.directTelemetry?.error({errorCode:o instanceof d.FloPayError&&o.code==="checkout_processing_timeout"?"REQUEST_TIMEOUT":"NETWORK_REQUEST_FAILED",stage:"session_read",requestCategory:"session_read",statusClass:i?`${Math.floor(i/100)}xx`:"network_error"}),o}}cacheSessionDisplayData(e,t,r){x(e,t,r)}clearSessionDisplayData(e){te(e)}async getVaultCapture(e,t){this.beginDirectTelemetryCheckout(e);let r=this.telemetryTimestamp();this.directTelemetry?.log({name:"vault.capture.requested",stage:"vault_request",requestCategory:"vault_capture",paymentMethodCategory:"card"});let s={"Content-Type":"application/json"};t&&(s["x-checkout-session-token"]=t);try{let o=await ne(`${this.baseUrl}/v1/checkouts/sessions/${encodeURIComponent(e)}/vault/capture`,{method:"POST",headers:s},H,a=>{this.telemetryHooks?.onRetry?.("vault_capture",a),this.directTelemetry?.log({name:"operation.retry",stage:"vault_request",requestCategory:"vault_capture",paymentMethodCategory:"card",attempt:a})});if(!o.ok)throw await N(o,"Failed to load the secure card form");let i=await o.json();return this.directTelemetry?.performance({stage:"vault_request",durationMs:Math.max(0,this.telemetryTimestamp()-r),durationMode:"machine",requestCategory:"vault_capture",paymentMethodCategory:"card",statusClass:"2xx"}),this.toVaultBlock(i)}catch(o){throw this.reportDirectFailure(o,"VAULT_LOAD_FAILED","vault_request","vault_capture","card"),o}}async getUnifiedCheckoutSession(e,t){let r=await this.getCheckoutSession(e,t),s=this.normalizeRawSession(r.data),o=r.vault;return o&&s.data.session&&(s.data.session.vault=this.toVaultBlock(o)),s}async processPayment(e,t,r){if(this.beginDirectTelemetryCheckout(t.sessionId),!t.nonce)throw this.directTelemetry?.terminal({outcome:"validation_rejected",stage:"processing",requestCategory:"process_payment"}),new d.FloPayError("processPayment requires `nonce` \u2014 pass the value returned from session creation.","validation_error",{code:"MissingCheckoutSessionToken",param:"nonce"});let s=this.telemetryTimestamp();this.directTelemetry?.log({name:"payment.processing.started",stage:"processing",requestCategory:"process_payment"});let{nonce:o,...i}=t,a;try{a=await fetch(`${this.baseUrl}/v1/checkouts/sessions/${encodeURIComponent(t.sessionId)}/process`,{method:"POST",headers:{"Content-Type":"application/json","x-checkout-session-token":o},body:JSON.stringify(i)})}catch(l){throw this.reportDirectFailure(l,"PAYMENT_PROCESSING_FAILED","processing","process_payment"),l}if(!a.ok&&a.status!==202)return this.directTelemetry?.error({errorCode:"PAYMENT_PROCESSING_FAILED",stage:"processing",requestCategory:"process_payment",statusClass:D(a.status)}),a;try{let l=await this.resolveProcessResponse(a,t.sessionId,{...r,nonce:o});return this.directTelemetry?.log({name:"payment.processing.completed",stage:"processing",requestCategory:"process_payment",statusClass:D(l.status)}),this.directTelemetry?.performance({stage:"processing",durationMs:Math.max(0,this.telemetryTimestamp()-s),durationMode:"machine",requestCategory:"process_payment",statusClass:D(l.status)}),l}catch(l){throw l instanceof d.FloPayError&&l.code==="checkout_processing_timeout"||this.reportDirectFailure(l,"PAYMENT_PROCESSING_FAILED","processing","process_payment"),l}}async patchAccountSnapshot(e,t,r,s){this.beginDirectTelemetryCheckout(e);let o=this.telemetryTimestamp();this.directTelemetry?.log({name:"operation.state_transition",stage:"processing",requestCategory:"account_snapshot"});let i=s?.timeoutMs??mt,a=new AbortController,l=()=>a.abort();s?.signal&&(s.signal.aborted?a.abort():s.signal.addEventListener("abort",l,{once:!0}));let c=setTimeout(()=>a.abort(),i);try{let u;try{u=await ne(`${this.baseUrl}/v1/checkouts/sessions/${encodeURIComponent(e)}/account`,{method:"PATCH",headers:{"Content-Type":"application/json","x-checkout-session-token":t},body:JSON.stringify(r),signal:a.signal},H,y=>{this.telemetryHooks?.onRetry?.("account_snapshot",y),this.directTelemetry?.log({name:"operation.retry",stage:"processing",requestCategory:"account_snapshot",attempt:y})})}finally{clearTimeout(c),s?.signal?.removeEventListener("abort",l)}if(!u.ok)throw await N(u,"Failed to persist account snapshot");this.directTelemetry?.performance({stage:"processing",durationMs:Math.max(0,this.telemetryTimestamp()-o),durationMode:"machine",requestCategory:"account_snapshot",statusClass:"2xx"})}catch(u){throw this.reportDirectFailure(u,"NETWORK_REQUEST_FAILED","processing","account_snapshot"),u}}async createSessionIntent(e,t,r,s){if(!t)throw new d.FloPayError("createSessionIntent requires the checkout session nonce.","validation_error",{code:"MissingCheckoutSessionToken",param:"nonce"});let o=r,i=o.paymentMethodType,a=typeof i=="string"&&i.trim().toLowerCase()==="card",l=typeof i=="string"&&i.length>0&&!a&&(typeof o.paymentMethodId=="string"||o.paymentMethodId===null),c=o.provider==="stripe"&&(o.paymentMethodCategory==="wallet"||o.paymentMethodCategory==="apm")&&(o.intentKind==="payment"||o.intentKind==="setup"),u=o.provider==="paypal"&&o.paymentMethodCategory==="wallet"&&o.paymentMethodType==="paypal"&&o.paymentMethodId===null&&o.intentKind==="payment";if(!l||!c&&!u)throw new d.FloPayError("Only wallet, APM, and PayPal session intents are supported.","validation_error",{code:"InvalidSessionIntentRequest"});let y=o.authorizationAttemptId;if(y!==void 0&&!(0,d.isUuidV4)(y))throw new d.FloPayError("authorizationAttemptId must be a v4 UUID identifying one buyer authorization attempt.","validation_error",{code:"InvalidAuthorizationAttemptId",param:"authorizationAttemptId"});let b=(0,d.isUuidV4)(y)?y:(0,d.randomUuidV4)();this.beginDirectTelemetryCheckout(e);let g=this.telemetryTimestamp();this.directTelemetry?.log({name:"payment.intent.started",stage:"processing",requestCategory:"intent_create"});let E={"Content-Type":"application/json","x-checkout-session-token":t,[d.IDEMPOTENCY_KEY_HEADER]:s?.idempotencyKey||b},k=!1;try{let P=await fetch(`${this.baseUrl}/v1/checkouts/sessions/${encodeURIComponent(e)}/intents`,{method:"POST",headers:E,body:JSON.stringify({...r,authorizationAttemptId:b}),signal:s?.signal});if(!P.ok)throw k=!0,this.directTelemetry?.error({errorCode:"PAYMENT_PROCESSING_FAILED",stage:"processing",requestCategory:"intent_create",statusClass:D(P.status)}),await N(P,"Failed to create checkout intent");let O=(await P.json()).data;if(!O||typeof O!="object")throw new d.FloPayError("Invalid checkout intent response.","api_error",{code:"InvalidSessionIntentResponse"});let p=O,z=p.paymentMethodType,q=(p.paymentMethodCategory==="wallet"||p.paymentMethodCategory==="apm")&&typeof z=="string"&&z.trim().toLowerCase()!=="card"&&(typeof p.paymentMethodId=="string"||p.paymentMethodId===null)&&typeof p.providerObjectId=="string",S=p.provider==="stripe"&&(p.intentKind==="payment"||p.intentKind==="setup")&&typeof p.clientSecret=="string",j=p.provider==="paypal"&&p.paymentMethodCategory==="wallet"&&p.paymentMethodType==="paypal"&&p.paymentMethodId===null&&p.intentKind==="payment"&&(p.providerObjectType==="order"||p.providerObjectType==="subscription")&&p.clientSecret===null,ie=p.provider===r.provider&&p.paymentMethodCategory===r.paymentMethodCategory&&p.paymentMethodType===r.paymentMethodType&&p.paymentMethodId===r.paymentMethodId&&p.intentKind===r.intentKind;if(!q||!S&&!j||!ie)throw new d.FloPayError("Invalid checkout intent response.","api_error",{code:"InvalidSessionIntentResponse"});return this.directTelemetry?.log({name:"payment.intent.completed",stage:"processing",requestCategory:"intent_create",statusClass:D(P.status)}),this.directTelemetry?.performance({stage:"processing",durationMs:Math.max(0,this.telemetryTimestamp()-g),durationMode:"machine",requestCategory:"intent_create",statusClass:D(P.status)}),p}catch(P){throw k||this.reportDirectFailure(P,"PAYMENT_PROCESSING_FAILED","processing","intent_create"),P}}async reportSessionIntentDecline(e,t,r,s){if(!t)throw new d.FloPayError("reportSessionIntentDecline requires the checkout session nonce.","validation_error",{code:"MissingCheckoutSessionToken",param:"nonce"});let o=r,i=o.providerDeclineReason,a=o.paymentMethodType,l=typeof i=="string"&&/^[a-z0-9][a-z0-9_.:-]{0,63}$/i.test(i)&&!/^(?:pm|pi|seti|tok|src|cus|sess|sk|pk)_/i.test(i),c=typeof a=="string"&&a.length>0&&a.trim().toLowerCase()!=="card"&&l,u=o.provider==="stripe"&&(o.paymentMethodCategory==="wallet"||o.paymentMethodCategory==="apm"),y=o.provider==="paypal"&&o.paymentMethodCategory==="wallet"&&o.paymentMethodType==="paypal";if(!c||!u&&!y)throw new d.FloPayError("Invalid non-card decline classification.","validation_error",{code:"InvalidSessionIntentDeclineRequest"});let b=y?{provider:"paypal",paymentMethodCategory:"wallet",paymentMethodType:"paypal",providerDeclineReason:i}:{provider:"stripe",paymentMethodCategory:o.paymentMethodCategory,paymentMethodType:o.paymentMethodType,providerDeclineReason:i},g=await fetch(`${this.baseUrl}/v1/checkouts/sessions/${encodeURIComponent(e)}/intents/decline`,{method:"POST",headers:{"Content-Type":"application/json","x-checkout-session-token":t},body:JSON.stringify(b),signal:s?.signal});if(!g.ok)throw await N(g,"Failed to report checkout decline")}async getPaymentsByEmail(e,t){this.beginDirectTelemetryOperation();let r=this.telemetryTimestamp();this.directTelemetry?.log({name:"operation.recovery.started",stage:"recovery",requestCategory:"other",paymentMethodCategory:"saved"});let s=t?.page??1,o=t?.limit??1,i=new URLSearchParams({email:e,page:String(s),limit:String(o),sortField:"createdAt",sortDirection:"DESC"});try{let a=await fetch(`${this.baseUrl}/v1/payments?${i.toString()}`,{method:"GET",signal:t?.signal,keepalive:!0});if(!a.ok)throw new d.FloPayError("Failed to fetch payments","api_error",{statusCode:a.status});let l=await a.json();return this.directTelemetry?.log({name:"operation.recovery.completed",stage:"recovery",requestCategory:"other",paymentMethodCategory:"saved",statusClass:"2xx"}),this.directTelemetry?.performance({stage:"recovery",durationMs:Math.max(0,this.telemetryTimestamp()-r),durationMode:"machine",requestCategory:"other",paymentMethodCategory:"saved",statusClass:"2xx"}),l}catch(a){throw this.reportDirectFailure(a,"RECOVERY_FAILED","recovery","other","saved"),a}}async createAndFetchSession(e){this.beginDirectTelemetryOperation();let t=this.telemetryTimestamp();this.directTelemetry?.log({name:"session.create.started",stage:"session_create",requestCategory:"session_create"});try{let r=await this.createAndFetchSessionRequest(e,t);return this.adoptDirectTelemetryCheckout(r.data.session?.id),this.directTelemetry?.log({name:"session.request.completed",stage:"session_complete",requestCategory:"session_create",statusClass:"2xx"}),this.directTelemetry?.performance({stage:"session_create",durationMs:this.telemetryTimestamp()-t,durationMode:"machine",requestCategory:"session_create",statusClass:"2xx"}),r}catch(r){if(!(r instanceof d.FloPayError&&r.code==="session_auto_completed"))try{this.telemetryHooks?.onSessionCreateFailure?.(r)}catch{}if(r instanceof d.FloPayError&&r.type==="validation_error")this.directTelemetry?.terminal({outcome:"validation_rejected",stage:"session_create",requestCategory:"session_create"});else if(!(r instanceof d.FloPayError&&r.code==="session_auto_completed")){let s=r instanceof d.FloPayError?r.statusCode:void 0;this.directTelemetry?.error({errorCode:r instanceof Error&&r.name==="AbortError"?"REQUEST_TIMEOUT":r instanceof TypeError?"NETWORK_REQUEST_FAILED":"CHECKOUT_SESSION_CREATE_FAILED",stage:"session_create",requestCategory:"session_create",statusClass:r instanceof Error&&r.name==="AbortError"?"timeout":s?`${Math.floor(s/100)}xx`:"network_error"})}throw r}}async createAndFetchSessionRequest(e,t){let r=e.products??(0,d.foldIntoProducts)(e.items,e.subscriptions),s=(0,d.resolveSessionCurrency)(e.currency,e.items,e.subscriptions,r);if(!s)throw new d.FloPayError("currency is required: pass `currency` on the session, or include a `currency` on the first item/subscription/product.","validation_error",{code:"CurrencyRequired",param:"currency"});let o={clientId:e.clientId,checkoutVersion:d.SDK_VERSION,successUrl:e.successUrl,cancelUrl:e.cancelUrl,currency:s,checkoutMode:e.checkoutMode??"full",products:r.map(g=>(0,d.buildProductPayload)(g,s)),accountData:{userId:e.account.userId,firstName:e.account.firstName??null,lastName:e.account.lastName??null,email:e.account.email,country:e.account.country??null,gender:e.account.gender??null,city:e.account.city??null,state:e.account.state??null,zip:e.account.zip??null,addressLine1:e.account.addressLine1??null,addressLine2:e.account.addressLine2??null},couponCodes:e.couponCodes??[]};e.tokenizedData&&(o.tokenizedData=e.tokenizedData),e.tagsData&&(o.tagsData=e.tagsData),e.utmMetadata?.length&&(o.utmMetadata=e.utmMetadata),e.avsCheck!==void 0&&(o.avsCheck=e.avsCheck),e.checkoutType&&(o.checkoutType=e.checkoutType),e.checkoutLayout&&(o.checkoutLayout=e.checkoutLayout),e.avsConfig&&(o.avsConfig=e.avsConfig);let i={"Content-Type":"application/json",[d.FLO_SDK_VERSION_HEADER]:d.SDK_VERSION},a=(0,d.resolveIdempotencyKey)(e.idempotencyKey);a&&(i[d.IDEMPOTENCY_KEY_HEADER]=a);let l,c=!1;for(let g=0;;g++){if(l=await ne(`${this.baseUrl}/v1/checkouts/sessions?expand=true`,{method:"POST",headers:i,body:JSON.stringify(o)},H,k=>{this.telemetryHooks?.onRetry?.("session_create",k),this.directTelemetry?.log({name:"operation.retry",stage:"session_create",requestCategory:"session_create",attempt:k})}),!c){c=!0;let k=`${Math.floor(l.status/100)}xx`;this.directTelemetry?.log({name:"session.request.first_byte",stage:"session_first_byte",requestCategory:"session_create",statusClass:k}),this.directTelemetry?.performance({stage:"session_first_byte",durationMs:this.telemetryTimestamp()-t,durationMode:"machine",requestCategory:"session_create",statusClass:k})}if(l.status===204)throw new d.FloPayError("Session auto-completed \u2014 payment method already on file","api_error",{code:"session_auto_completed"});if(l.ok)break;let E=await N(l,"Failed to create checkout session");if(E.code===d.IDEMPOTENCY_IN_PROGRESS_CODE&&g<ft){try{this.telemetryHooks?.onRetry?.("session_create",g+1),this.directTelemetry?.log({name:"operation.retry",stage:"session_create",requestCategory:"session_create",attempt:g+1})}catch{}await ue(150*2**g);continue}throw E}let u=await l.json();if(u.data&&"gateways"in u.data){this.autoCacheDisplayData(u.data.uuid,e);let g=this.mergeCachedDisplayData(u.data),E=this.normalizeRawSession(g);return u.vault&&E.data.session&&(E.data.session.vault=this.toVaultBlock(u.vault)),{...E,autoProcessingError:u.autoProcessingError,autoProcessingAttempted:u.autoProcessingAttempted,autoProcessingPending:u.autoProcessingPending}}let y=u.data?.uuid;if(!y)throw new d.FloPayError("No session ID returned","api_error");return this.autoCacheDisplayData(y,e),this.adoptDirectTelemetryCheckout(y),{...await this.getUnifiedCheckoutSession(y),autoProcessingError:u.autoProcessingError,autoProcessingAttempted:u.autoProcessingAttempted,autoProcessingPending:u.autoProcessingPending}}async waitForCheckoutSessionCompletion(e,t){this.beginDirectTelemetryCheckout(e);let r=this.telemetryTimestamp();this.directTelemetry?.log({name:"operation.recovery.started",stage:"recovery",requestCategory:"session_read",paymentMethodCategory:"saved"});let s=t?.timeoutMs??ut,o=Date.now()+s,i=this.clampRetryAfterMs(t?.initialDelayMs??Ee),a=0;try{for(;;){let l=o-Date.now();if(l<=0)throw re();if(i>0){try{a+=1,this.telemetryHooks?.onRetry?.("session_read",a),this.directTelemetry?.log({name:"operation.retry",stage:"recovery",requestCategory:"session_read",paymentMethodCategory:"saved",attempt:a})}catch{}if(await ue(Math.min(i,l)),Date.now()>=o)throw re()}let c=await this.getUnifiedCheckoutSession(e,t?.nonce),u=c.data.session?.status;if(u==="complete"||u==="expired")return this.directTelemetry?.log({name:"operation.recovery.completed",stage:"recovery",requestCategory:"session_read",paymentMethodCategory:"saved"}),this.directTelemetry?.performance({stage:"recovery",durationMs:Math.max(0,this.telemetryTimestamp()-r),durationMode:"machine",requestCategory:"session_read",paymentMethodCategory:"saved"}),c;if(Date.now()>=o)throw re();i=this.clampRetryAfterMs(Math.max(i*2,dt))}}catch(l){throw l instanceof d.FloPayError&&l.code==="checkout_processing_timeout"&&this.reportDirectFailure(l,"RECOVERY_FAILED","recovery","session_read","saved"),l}}normalizeRawSession(e){let t=e.gateways??{},r=[],s={session:this.toCheckoutSession(e)},o=t.stripe;if(o?.publishableKey){r.push("stripe");let l=[e.stripeClientSecret,o.stripeClientSecret].find(c=>typeof c=="string"&&c.length>0);s.stripe={clientSecret:l??"",publishableKey:o.publishableKey??void 0,paypalPublishableKey:o.paypalPublishableKey??void 0,environment:o.environment,enabledPaymentMethods:Array.isArray(o.enabledPaymentMethods)?o.enabledPaymentMethods.filter(c=>typeof c=="string"):void 0}}let i=t.paypal;return i?.publishableKey&&(r.push("paypal"),s.paypal={publishableKey:i.publishableKey,environment:i.environment}),{providers:r,mode:"tokenize",data:s,raw:{data:e}}}toCheckoutSession(e){let t=e.products??[],r=typeof e.totalAmount=="number"&&Number.isFinite(e.totalAmount),s=t.reduce((c,u)=>c+(u.overrideAmount??u.totalAmount??0),0),o=r?e.totalAmount:s,i=Math.round(o*100),a=e.currency??t[0]?.currency??"USD",l=t.some(c=>c.type==="subscription")?"subscription":"payment";return{id:e.uuid,clientSecret:e.nonce,mode:l,status:this.toCheckoutSessionStatus(e.status),amount:i,currency:a,customer:{id:e.accountData.userId,email:e.accountData.email,firstName:e.accountData.firstName,lastName:e.accountData.lastName,country:e.accountData.country??void 0,city:e.accountData.city??void 0,state:e.accountData.state??void 0,zip:e.accountData.zip??void 0,gender:e.accountData.gender??void 0,line1:e.accountData.addressLine1??void 0,line2:e.accountData.addressLine2??void 0},metadata:{},checkoutMode:e.checkoutMode,providerPaymentMethodId:typeof e.providerPaymentMethodId=="string"?e.providerPaymentMethodId:null,products:t.map(c=>({...c,totalAmount:typeof c.totalAmount=="number"?c.totalAmount:void 0,overrideAmount:typeof c.overrideAmount=="number"?c.overrideAmount:null,currency:typeof c.currency=="string"?c.currency:void 0,metadata:c.metadata??null})),successUrl:e.successUrl,cancelUrl:e.cancelUrl,coupons:e.coupons,subtotalAmount:e.subtotalAmount,discountAmount:e.discountAmount,totalAmount:e.totalAmount,createdAt:e.createdAt,gateways:e.gateways,accountData:e.accountData,tagsData:e.tagsData}}toVaultBlock(e){return{html:typeof e.html=="string"?e.html:void 0,url:typeof e.url=="string"?e.url:void 0,messageToken:typeof e.messageToken=="string"?e.messageToken:void 0,expectedOrigin:typeof e.expectedOrigin=="string"?e.expectedOrigin:void 0}}toCheckoutSessionStatus(e){return e==="completed"?"complete":e==="expired"?"expired":"open"}async resolveProcessResponse(e,t,r){if(e.status!==202)return e;let s=await e.json().catch(()=>null),o=this.toCheckoutProcessingPending(s,e,t),i=await this.waitForCheckoutSessionCompletion(o.sessionId,{initialDelayMs:o.retryAfterMs,timeoutMs:r?.pollTimeoutMs,nonce:r?.nonce});if(i.data.session?.status==="complete")return new Response(null,{status:204,statusText:"No Content"});throw i.data.session?.status==="expired"?new d.FloPayError("Checkout session has expired.","api_error",{code:"checkout_session_expired"}):re()}toCheckoutProcessingPending(e,t,r){let s=t.headers.get("Retry-After"),o=s===null||s.trim()===""?void 0:Number(s),i=o!==void 0&&Number.isFinite(o)?o*1e3:void 0;return{type:"checkout_processing",sessionId:V(e,"sessionId")??r,retryAfterMs:this.clampRetryAfterMs(gt(e,"retryAfterMs")??i??Ee),statusUrl:V(e,"statusUrl"),sessionUrl:V(e,"sessionUrl")}}clampRetryAfterMs(e){return Math.max(0,Math.min(e,pt))}autoCacheDisplayData(e,t){if(!e)return;let r=t.products??(0,d.foldIntoProducts)(t.items,t.subscriptions);if(r.length===0&&!t.currency)return;let s=t.products!==void 0,o=(0,d.resolveSessionCurrency)(t.currency,s?void 0:t.items,s?void 0:t.subscriptions,r);x(e,{currency:o??void 0,products:r.map(i=>({code:i.code??i.providerItemId??i.providerPlanId,type:i.type,name:i.name??i.itemName??i.providerItemName??i.subscriptionName??i.providerPlanName??null,totalAmount:i.totalAmount,overrideAmount:i.overrideAmount,currency:i.currency??o??void 0}))})}mergeCachedDisplayData(e){let t=ee(e.uuid),r=new Map,s=i=>i?`code:${i}`:void 0;for(let i of t?.products??[]){let a=s(i.code);a&&r.set(a,i)}let o=(e.products??[]).map(i=>{let a=s(i.code),l=a?r.get(a):void 0;return{...i,name:i.name??l?.name??null,totalAmount:i.totalAmount??l?.totalAmount,overrideAmount:i.overrideAmount??l?.overrideAmount,currency:i.currency??l?.currency}});return{...e,currency:e.currency??t?.currency,products:o}}};function Me(n,e){let t=A;return new t(n,e)}function Re(n){return{payment:"payment",address:"address"}[n]}function Se(n){switch(n){case"night":return"night";case"flat":return"flat";default:return"stripe"}}function pe(n){return n?JSON.stringify(n.map(e=>e.trim().toLowerCase())):null}function Ae(n){let e=n;return{mount(t){e.mount(t)},unmount(){e.unmount()},update(t){e.update(t)},on(t,r){e.on?.(t,r)},off(t,r){e.off?.(t,r)},destroy(){e.destroy()}}}function vt(n){return{billing_details:{...n.email?{email:n.email}:{},...n.name?{name:n.name}:{},...n.address?{address:{...n.address.country?{country:n.address.country}:{},...n.address.postal_code?{postal_code:n.address.postal_code}:{},...n.address.city?{city:n.address.city}:{},...n.address.line1?{line1:n.address.line1}:{},...n.address.line2?{line2:n.address.line2}:{},...n.address.state?{state:n.address.state}:{}}}:{}}}}var K=class{constructor(){this.name="stripe";this.stripe=null;this.elements=null;this.appliedAppearanceKey=null;this.appliedPaymentMethodTypesKey=null;this.appliedClientSecret=null;this.verifiedClientSecret=null;this.verifiedPaymentMethodTypesKey=null}async initialize(e){if(typeof window>"u")return;let t=await(0,Ie.loadStripe)(e.publishableKey,{locale:e.locale??"auto"});if(!t)throw new h.FloPayError("Failed to initialize Stripe. Check your publishable key.","authentication_error");this.stripe=t}getElements(e){if(!this.stripe)throw new h.FloPayError("StripeAdapter not initialized. Call initialize() first.","api_error");let t=e?.appearance?{theme:Se(e.appearance.theme),variables:e.appearance.variables,rules:e.appearance.rules}:void 0,r=t?JSON.stringify(t):null,s=pe(e?.paymentMethodTypes),o=e?.clientSecret??null;if(this.elements&&s&&(s!==this.appliedPaymentMethodTypesKey||o!==this.appliedClientSecret)&&(this.elements=null,this.appliedAppearanceKey=null,this.appliedPaymentMethodTypesKey=null,this.appliedClientSecret=null,this.verifiedClientSecret=null,this.verifiedPaymentMethodTypesKey=null),this.elements)r!==this.appliedAppearanceKey&&(this.elements.update({appearance:t??{}}),this.appliedAppearanceKey=r);else{let i,a=e?.amount??0,l=(e?.currency??"usd").toLowerCase(),c=e?.paymentMethodCreation??"manual";e?.clientSecret?i={clientSecret:e.clientSecret}:a>0?(i={mode:"payment",amount:a,currency:l,paymentMethodCreation:c},e?.setupFutureUsage&&(i.setupFutureUsage=e.setupFutureUsage)):i={mode:"setup",currency:l,paymentMethodCreation:c},!e?.clientSecret&&e?.paymentMethodTypes&&(i.paymentMethodTypes=e.paymentMethodTypes),t&&(i.appearance=t),this.elements=this.stripe.elements(i),this.appliedAppearanceKey=r,this.appliedPaymentMethodTypesKey=s,this.appliedClientSecret=o,this.verifiedClientSecret=null,this.verifiedPaymentMethodTypesKey=null}return this.elements}async assertClientSecretPaymentMethods(e,t){if(!this.stripe)throw new h.FloPayError("StripeAdapter not initialized. Call initialize() first.","api_error");let r,s=!1;if((0,h.isSetupIntentClientSecret)(e)){let{setupIntent:l,error:c}=await this.stripe.retrieveSetupIntent(e);r=l,s=!!c}else{let{paymentIntent:l,error:c}=await this.stripe.retrievePaymentIntent(e);r=l,s=!!c}let o=r?.payment_method_types;if(s||!Array.isArray(o))throw new h.FloPayError("Unable to verify the payment methods configured for this client secret.","api_error",{param:"clientSecret"});let i=new Set(t.map(l=>l.toLowerCase()));if(o.some(l=>typeof l!="string"||!i.has(l.trim().toLowerCase()))||o.length===0)throw new h.FloPayError("The client-secret intent must enable only declared non-card payment methods.","validation_error",{param:"clientSecret"})}async createElement(e,t){let r=t;if(e==="payment"){let l=t.paymentMethodTypes?.map(c=>c.trim()).filter(c=>c&&c.toLowerCase()!=="card");if(!l?.length)throw new h.FloPayError("At least one supported non-card payment method is required.","validation_error",{param:"paymentMethodTypes"});if(r={...t,paymentMethodTypes:l},r.clientSecret){let c=pe(l);this.elements&&this.appliedClientSecret===r.clientSecret&&this.appliedPaymentMethodTypesKey===c&&this.verifiedClientSecret===r.clientSecret&&this.verifiedPaymentMethodTypesKey===c||await this.assertClientSecretPaymentMethods(r.clientSecret,l)}}let s=this.getElements(r);e==="payment"&&r.clientSecret&&(this.verifiedClientSecret=r.clientSecret,this.verifiedPaymentMethodTypesKey=pe(r.paymentMethodTypes));let o=Re(e),i={};r.layout&&(i.layout=r.layout),r.defaultValues&&(i.defaultValues=r.defaultValues),r.readOnly&&(i.readOnly=r.readOnly),r.mode&&(i.mode=r.mode);let a=s.create(o,i);return Ae(a)}getElement(e){if(!this.elements)return null;let t=Re(e),r=this.elements.getElement(t);return r?Ae(r):null}async submitElements(){if(!this.stripe||!this.elements)return{error:new h.FloPayError("Stripe not initialized","api_error")};let{error:e}=await this.elements.submit();return e?{error:new h.FloPayError(e.message??"Validation failed","validation_error")}:{}}async confirmPayment(e){if(!this.stripe||!this.elements)throw new h.FloPayError("StripeAdapter not initialized or no elements created.","api_error");let t=e.billingDetails,r=t?vt(t):void 0,{error:s,paymentIntent:o}=await this.stripe.confirmPayment({elements:this.elements,clientSecret:e.clientSecret,confirmParams:{return_url:e.returnUrl??window.location.href,...r?{payment_method_data:r}:{}},redirect:"if_required"});return s?{status:"failed",error:new h.FloPayError(s.message??"Payment failed","api_error",{code:s.code,declineCode:s.decline_code})}:o?{status:{succeeded:"succeeded",processing:"processing",requires_action:"requires_action",requires_payment_method:"failed",canceled:"failed"}[o.status]??"failed",paymentIntentId:o.id,paymentMethodId:this.extractPaymentMethodId(o.payment_method)}:{status:"failed",error:new h.FloPayError("No payment intent returned","api_error")}}extractPaymentMethodId(e){if(typeof e=="string"&&e.startsWith("pm_"))return e;if(e&&typeof e=="object"&&typeof e.id=="string")return e.id}async confirmPayPalPayment(e){if(!this.stripe)return{status:"failed",error:new h.FloPayError("Stripe not initialized","api_error")};let t=e.billingApiUrl.replace(/\/+$/,"");if(this.elements){let{error:o}=await this.elements.submit();if(o)return{status:"failed",error:new h.FloPayError(o.message??"PayPal payment failed","validation_error",{code:o.code})}}let r;try{let o=await new A(t).createSessionIntent(e.sessionId,e.nonce??"",{provider:"stripe",paymentMethodCategory:"wallet",paymentMethodType:"paypal",paymentMethodId:null,intentKind:"payment"});if(o.provider!=="stripe")throw new h.FloPayError("Invalid provider returned for PayPal intent","api_error");r=o.clientSecret}catch(o){return{status:"failed",error:o instanceof h.FloPayError?o:new h.FloPayError("Failed to create PayPal payment intent","api_error")}}let{error:s}=await this.stripe.confirmPayment({clientSecret:r,elements:this.elements??void 0,confirmParams:{return_url:e.returnUrl}});if(s){if(e.nonce)try{await new A(t).reportSessionIntentDecline(e.sessionId,e.nonce,{provider:"stripe",paymentMethodCategory:"wallet",paymentMethodType:"paypal",providerDeclineReason:s.code??"provider_declined"})}catch{}return{status:"failed",error:new h.FloPayError(s.message??"PayPal payment failed","api_error",{code:s.code})}}return{status:"processing"}}async resumePayPalPayment(){if(!this.stripe||typeof window>"u")return null;let e=new URLSearchParams(window.location.search),t=e.get("payment_intent"),r=e.get("payment_intent_client_secret"),s=e.get("redirect_status");if(!t||!r)return null;if(s==="failed")return{status:"failed",error:new h.FloPayError("PayPal payment was declined. Please try again.","api_error")};let{paymentIntent:o,error:i}=await this.stripe.retrievePaymentIntent(r);if(i)return{status:"failed",error:new h.FloPayError(i.message??"Failed to retrieve PayPal payment","api_error")};if(o&&(o.status==="requires_capture"||o.status==="succeeded")){let a=typeof o.payment_method=="string"?o.payment_method:o.payment_method?.id,l=new URL(window.location.href);return l.searchParams.delete("payment_intent"),l.searchParams.delete("payment_intent_client_secret"),l.searchParams.delete("redirect_status"),window.history.replaceState({},"",l.toString()),{status:o.status,paymentIntentId:o.id,paymentMethodId:a}}return{status:"failed",error:new h.FloPayError("PayPal payment was not completed. Please try again.","api_error")}}getRawProvider(){return this.stripe}createPayPalElements(e){if(!this.stripe)return null;let t={mode:"payment",amount:e.amount??0,currency:(e.currency??"usd").toLowerCase(),captureMethod:"manual"};return e.setupFutureUsage&&(t.setupFutureUsage=e.setupFutureUsage),e.appearance&&(t.appearance={theme:Se(e.appearance.theme),variables:e.appearance.variables,rules:e.appearance.rules}),this.stripe.elements(t)}destroy(){this.elements=null,this.appliedAppearanceKey=null,this.appliedPaymentMethodTypesKey=null,this.appliedClientSecret=null,this.verifiedClientSecret=null,this.verifiedPaymentMethodTypesKey=null,this.stripe=null}};var w=require("@flopay/shared");var xe=require("@flopay/shared"),B=class{constructor(e,t){this.elementMap=new Map;this.provider=e,this.baseOptions=t??{}}async create(e,t){let r={...this.baseOptions,...t};if(e==="payment"){let a=r.paymentMethodTypes?.map(l=>l.trim()).filter(l=>l&&l.toLowerCase()!=="card");if(!a?.length)throw new xe.FloPayError("At least one supported non-card payment method is required.","validation_error",{param:"paymentMethodTypes"});r.paymentMethodTypes=a}let s=this.provider.getElement(e);if(s)return this.elementMap.set(e,s),s;let o=this.elementMap.get(e);o&&o.destroy();let i=await this.provider.createElement(e,r);return this.elementMap.set(e,i),i}getElement(e){return this.elementMap.get(e)??null}async submit(){return{}}destroy(){for(let e of this.elementMap.values())e.destroy();this.elementMap.clear()}};var C=require("@flopay/shared");var me="flopay-vault",De={ready:["vault.widget.ready","vault_ready"],submitting:["vault.submission.started","vault_submit"],blocked:["operation.state_transition","vault_submit"],action_required:["vault.action.required","three_ds_handoff"]};function $(n){let e={class:n.class,stage:n.stage};"code"in n&&(e.code=n.code),"provider"in n&&n.provider&&(e.provider=n.provider),"paymentMethodCategory"in n&&n.paymentMethodCategory&&(e.paymentMethodCategory=n.paymentMethodCategory),"outcome"in n&&(e.outcome=n.outcome),"durationMs"in n&&n.durationMs!==void 0&&(e.durationMs=n.durationMs),"durationMode"in n&&n.durationMode&&(e.durationMode=n.durationMode);try{globalThis.Sentry?.addBreadcrumb?.({category:"flopay.telemetry",level:n.class==="technical_error"?"error":"info",message:n.class==="lifecycle"?n.name:n.class==="technical_error"?n.code:n.class==="expected_outcome"?n.outcome:"sdk.performance",data:e})}catch{}}function oe(n,e){return(0,C.buildTelemetryLogEvent)({eventId:"11111111-1111-4111-8111-111111111111",name:n,stage:e,sequence:0,provider:"pcivault",paymentMethodCategory:"card"})}function Fe(n){return n?{errorCode:"VAULT_SUBMIT_FAILED",stage:"vault_submit"}:{errorCode:"VAULT_LOAD_FAILED",stage:"vault_mount"}}function Tt(n,e){if(n==="complete"||n==="decline")return(0,C.buildTelemetryTerminalEvent)({eventId:"22222222-2222-4222-8222-222222222222",outcome:n==="complete"?"payment_succeeded":"payment_declined",sequence:0,provider:"pcivault",paymentMethodCategory:"card"});if(n==="error"){let s=Fe(e);return(0,C.buildTelemetryErrorEvent)({eventId:"33333333-3333-4333-8333-333333333333",...s,sequence:0,provider:"pcivault",paymentMethodCategory:"card"})}let[t,r]=De[n];return oe(t,r)}function _t(n){if(typeof n!="object"||n===null)return!1;let e=n;return e.source===me&&(e.type==="ready"||e.type==="submitting"||e.type==="blocked"||e.type==="complete"||e.type==="decline"||e.type==="error"||e.type==="action_required")}function wt(n){if(typeof n!="object"||n===null)return!1;let e=n;return e.source===me&&e.type==="validation"&&Array.isArray(e.messages)}function Pt(n){if(typeof n!="object"||n===null)return!1;let e=n;return e.source===me&&e.type==="resize"&&typeof e.height=="number"&&Number.isFinite(e.height)}var F=class{constructor(e={},t){this.provider="pcivault";this.container=null;this.messageHandler=null;this.actionOverlay=null;this.threeDsReturnHandler=null;this.messageToken=null;this.expectedOrigin=null;this.theme=null;this.submitGateBlocked=!1;this.cardFieldOrder=null;this.cardAutoFocus=!0;this.captureRequestedAt=0;this.vaultReadyReported=!1;this.submissionStarted=!1;this.submissionStartedAt=null;this.listeners=new Map;this.config=e,this.ownsTelemetryReporter=!t&&e.telemetry!==!1,this.telemetryReporter=t?.reporter??(this.ownsTelemetryReporter?new v({billingApiUrl:(0,C.resolveBillingApiUrl)(),sdkVersion:C.SDK_VERSION}):void 0),this.requestedAt=t?.requestedAt}async mount(e,t){this.ownsTelemetryReporter&&!this.telemetryReporter&&(this.telemetryReporter=new v({billingApiUrl:(0,C.resolveBillingApiUrl)(),sdkVersion:C.SDK_VERSION}));let r=this.telemetryReporter?.now?.()??_();if(this.captureRequestedAt=this.requestedAt??r,this.vaultReadyReported=!1,this.submissionStarted=!1,this.submissionStartedAt=null,typeof window>"u"||typeof document>"u")throw this.reportVaultLoadFailure(),new C.FloPayError("The vault card form is only available in the browser.","api_error",{code:"card_capture_no_window"});if(!t?.html||!t.html.trim())throw this.reportVaultLoadFailure(),new C.FloPayError("No vault capture widget HTML was provided to mount the secure card form.","api_error",{code:"card_capture_no_widget_html"});this.container=e,this.messageToken=t.messageToken??null,this.expectedOrigin=t.expectedOrigin??this.config.expectedOrigin??null,this.theme=t.theme??null;try{this.attachMessageListener(),this.injectWidget(e,t.html)}catch(s){throw this.reportVaultLoadFailure(),s}this.postTheme(),this.postSubmitGate(),this.postCardFieldOrder(),$(oe("vault.widget.mounted","vault_mount")),this.telemetryReporter?.log({name:"vault.widget.mounted",stage:"vault_mount",provider:"pcivault",paymentMethodCategory:"card"}),this.emit("ready",{sessionId:this.config.sessionId})}reportVaultLoadFailure(){this.telemetryReporter?.error({errorCode:"VAULT_LOAD_FAILED",stage:"vault_mount",provider:"pcivault",paymentMethodCategory:"card"})}on(e,t){let r=this.listeners.get(e);return r||(r=new Set,this.listeners.set(e,r)),r.add(t),()=>{this.listeners.get(e)?.delete(t)}}unmount(){this.hideActionRequiredOverlay(),this.messageHandler&&(window.removeEventListener("message",this.messageHandler),this.messageHandler=null),this.container&&(this.container.replaceChildren(),this.container=null),this.messageToken=null,this.expectedOrigin=null,this.ownsTelemetryReporter&&(this.telemetryReporter?.destroy(),this.telemetryReporter=void 0)}injectWidget(e,t){e.innerHTML=t;let r=Array.from(e.querySelectorAll("script"));for(let s of r){let o=document.createElement("script");for(let i of Array.from(s.attributes))o.setAttribute(i.name,i.value);o.text=s.text,s.replaceWith(o)}}attachMessageListener(){if(this.messageHandler)return;let e=t=>{if(this.expectedOrigin&&t.origin!==this.expectedOrigin)return;let r=t.data;if(Pt(r)){if(this.messageToken&&r.messageToken!==this.messageToken)return;this.applyHeight(r.height);return}if(wt(r)){if(this.messageToken&&r.messageToken!==this.messageToken)return;let a=r.messages.filter(l=>typeof l=="string"&&l.trim()).join(" ");this.emit("validation",{sessionId:this.config.sessionId,message:a||void 0});return}if(!_t(r)||this.messageToken&&r.messageToken!==this.messageToken)return;let s=this.config.sessionId,o=typeof r.sessionId=="string"?r.sessionId:void 0;if(s&&o&&o!==s||(r.type==="complete"||r.type==="decline")&&s&&o!==s)return;let i={sessionId:r.sessionId??this.config.sessionId,intentId:r.intentId,declineReason:r.declineReason,message:r.message,nextActionRedirectUrl:r.nextActionRedirectUrl};r.type==="submitting"&&(this.submissionStarted=!0,this.submissionStartedAt=this.telemetryReporter?.now?.()??_()),$(Tt(r.type,this.submissionStarted)),this.reportOutcome(r.type),r.type==="ready"&&(this.postTheme(),this.postSubmitGate(),this.postCardFieldOrder()),r.type==="action_required"&&r.nextActionRedirectUrl&&this.showActionRequiredOverlay(r.nextActionRedirectUrl),(r.type==="complete"||r.type==="decline"||r.type==="error"||r.type==="submitting")&&this.hideActionRequiredOverlay(),this.emit(r.type,i)};this.messageHandler=e,window.addEventListener("message",e)}reportOutcome(e){let t=this.telemetryReporter;if(!t)return;if(e==="ready"&&!this.vaultReadyReported&&(this.vaultReadyReported=!0,t.performance({stage:"vault_ready",durationMs:Math.max(0,t.now()-this.captureRequestedAt),durationMode:"machine",provider:"pcivault",paymentMethodCategory:"card"})),e==="complete"||e==="decline"){t.log({name:"vault.terminal",stage:"completion",provider:"pcivault",paymentMethodCategory:"card"}),t.terminal({outcome:e==="complete"?"payment_succeeded":"payment_declined",provider:"pcivault",paymentMethodCategory:"card"});return}if(e==="error"){let o=Fe(this.submissionStarted);t.log({name:"vault.terminal",stage:o.stage,provider:"pcivault",paymentMethodCategory:"card"}),t.error({...o,provider:"pcivault",paymentMethodCategory:"card"});return}if(e==="action_required"){t.log({name:"vault.action.required",stage:"three_ds_handoff",provider:"pcivault",paymentMethodCategory:"card"}),t.log({name:"vault.three_ds.handoff",stage:"three_ds_handoff",provider:"pcivault",paymentMethodCategory:"card"});let o=this.submissionStartedAt;this.submissionStartedAt=null,o!==null&&t.performance({stage:"three_ds_handoff",durationMs:Math.max(0,t.now()-o),durationMode:"machine",provider:"pcivault",paymentMethodCategory:"card"}),t.terminal({outcome:"action_required",stage:"three_ds_handoff",provider:"pcivault",paymentMethodCategory:"card"});return}let[r,s]=De[e];t.log({name:r,stage:s,provider:"pcivault",paymentMethodCategory:"card"})}applyTheme(e){this.theme=e,this.postTheme()}postTheme(){if(!this.theme||!this.container)return;let t=this.container.querySelector("iframe")?.contentWindow;if(t)try{t.postMessage({source:"flopay-vault-host",type:"theme",theme:this.theme},"*")}catch{}}setSubmitGate(e){this.submitGateBlocked=e,this.postSubmitGate()}postSubmitGate(){if(!this.container)return;let t=this.container.querySelector("iframe")?.contentWindow;if(t)try{t.postMessage({source:"flopay-vault-host",type:"gate",blocked:this.submitGateBlocked},"*")}catch{}}setCardFieldOrder(e,t){this.cardFieldOrder=e,this.cardAutoFocus=t,this.postCardFieldOrder()}postCardFieldOrder(){if(!this.container)return;let t=this.container.querySelector("iframe")?.contentWindow;if(t)try{t.postMessage({source:"flopay-vault-host",type:"fieldOrder",order:this.cardFieldOrder,autoFocus:this.cardAutoFocus},"*")}catch{}}emit(e,t){for(let r of this.listeners.get(e)??[])r(t)}showActionRequiredOverlay(e){if(typeof document>"u")return;if(this.actionOverlay){let i=this.actionOverlay.querySelector("iframe");i instanceof HTMLIFrameElement&&(i.src=e);return}let t=document.createElement("div");t.setAttribute("data-flopay-action-required","1"),t.style.cssText=["position:fixed","inset:0","z-index:2147483647","background:rgba(15,23,42,0.6)","display:flex","align-items:center","justify-content:center","padding:16px"].join(";");let r=document.createElement("iframe");r.setAttribute("title","Card authentication"),r.setAttribute("allow","payment"),r.style.cssText=["width:min(100%,460px)","height:min(100%,640px)","border:0","border-radius:12px","background:#fff","box-shadow:0 12px 30px rgba(0,0,0,0.35)"].join(";"),r.src=e,t.appendChild(r);let s=document.createElement("button");s.type="button",s.setAttribute("aria-label","Close card authentication"),s.textContent="\xD7",s.style.cssText=["position:fixed","top:20px","right:20px","width:40px","height:40px","border:0","border-radius:9999px","background:#fff","color:#0f172a","font-size:28px","line-height:40px","cursor:pointer","box-shadow:0 4px 14px rgba(0,0,0,0.25)"].join(";"),s.addEventListener("click",()=>this.abandonActionRequiredOverlay()),t.appendChild(s),t.addEventListener("click",i=>{i.target===t&&this.abandonActionRequiredOverlay()});let o=i=>{if(i.source!==r.contentWindow)return;let a=i.data;if(!a||typeof a!="object")return;let l=a;l.source==="flopay-vault-3ds-return"&&($(oe("vault.three_ds.returned","three_ds_return")),this.telemetryReporter?.log({name:"vault.three_ds.returned",stage:"three_ds_return",provider:"pcivault",paymentMethodCategory:"card"}),this.hideActionRequiredOverlay(),this.postActionCompleted(l.status))};window.addEventListener("message",o),this.threeDsReturnHandler=o,document.body.appendChild(t),this.actionOverlay=t,$(oe("vault.three_ds.handoff","three_ds_handoff"))}postActionCompleted(e){if(!this.container)return;let r=this.container.querySelector("iframe")?.contentWindow;if(r)try{r.postMessage({source:"flopay-vault-host",type:"action_completed",status:typeof e=="string"?e:"unknown"},"*")}catch{}}abandonActionRequiredOverlay(){if(!this.actionOverlay)return;let e=(0,C.buildTelemetryTerminalEvent)({eventId:"77777777-7777-4777-8777-777777777777",outcome:"customer_abandoned",stage:"three_ds_handoff",sequence:0,provider:"pcivault",paymentMethodCategory:"card"});$(e),this.telemetryReporter?.terminal({outcome:"customer_abandoned",stage:"three_ds_handoff",provider:"pcivault",paymentMethodCategory:"card"}),this.hideActionRequiredOverlay(),this.postActionCompleted("abandoned")}hideActionRequiredOverlay(){this.threeDsReturnHandler&&(window.removeEventListener("message",this.threeDsReturnHandler),this.threeDsReturnHandler=null),this.actionOverlay&&(this.actionOverlay.parentNode?.removeChild(this.actionOverlay),this.actionOverlay=null)}applyHeight(e){let t=this.container?.querySelector("iframe");if(!t)return;let r=Math.max(0,Math.min(Math.ceil(e),2e3));t.style.height=`${r}px`}};function Oe(n,e,t){let r=F;return new r(n,{reporter:e,requestedAt:t})}var qe=Symbol.for("@flopay/js.telemetry.bridge.v1");function Ue(n,e,t){let r=()=>e?.now()??t();Object.defineProperty(n,qe,{configurable:!1,enumerable:!1,writable:!1,value:{error:o=>e?.error(o),log:o=>e?.log(o),performance:o=>e?.performance(o),terminal:o=>e?.terminal(o),now:r,elapsed:o=>Math.max(0,r()-o),setCheckoutContext:o=>e?.setCheckoutContext(o),beginCheckout:(o={})=>e?.beginCheckout(o)??r(),disable:()=>e?.disable()}})}function Le(n){return n[qe]}function ye(n){if(!n)return!1;let e=n.code?.toLowerCase()??"";return!!n.declineCode||e.includes("declin")}function bt(n){return n==="stripe"||n==="paypal"||n==="pcivault"?n:"other"}var G=class{constructor(e,t,r){this.currentElements=null;this.provider=e,this.config=t,this.telemetryReporter=r??new v({billingApiUrl:(0,w.resolveBillingApiUrl)(t.billingApiUrl),sdkVersion:w.SDK_VERSION,enabled:t.telemetry!==!1}),Ue(this,this.telemetryReporter,_)}now(){return this.telemetryReporter?.now?.()??_()}elements(e){return this.currentElements&&this.currentElements.destroy(),this.currentElements=new B(this.provider,{appearance:this.config.appearance,...e}),this.currentElements}async submitElements(){return this.provider.submitElements()}cardCapture(e){let t=this.now();return this.telemetryReporter?.log({name:"vault.capture.requested",stage:"vault_request",provider:"pcivault",paymentMethodCategory:"card"}),this.telemetryReporter?Oe({sessionId:e?.sessionId},this.telemetryReporter,t):new F({sessionId:e?.sessionId,telemetry:!1})}async confirmPayPalPayment(e){let t=this.now();this.telemetryReporter?.log({name:"payment.method.selected",stage:"processing",provider:"paypal",paymentMethodCategory:"paypal"}),this.telemetryReporter?.log({name:"payment.intent.started",stage:"processing",provider:"paypal",paymentMethodCategory:"paypal",requestCategory:"intent_create"});try{let r=await this.provider.confirmPayPalPayment(e);return this.telemetryReporter?.performance({stage:"processing",durationMs:this.now()-t,durationMode:"machine",provider:"paypal",paymentMethodCategory:"paypal"}),r.error||this.telemetryReporter?.log({name:"payment.intent.completed",stage:"processing",provider:"paypal",paymentMethodCategory:"paypal",requestCategory:"intent_create",statusClass:"2xx"}),r.status==="requires_action"?(this.telemetryReporter?.log({name:"provider.redirect.started",stage:"redirect",provider:"paypal",paymentMethodCategory:"paypal"}),this.telemetryReporter?.terminal({outcome:"action_required",stage:"redirect",provider:"paypal",paymentMethodCategory:"paypal"})):r.status==="succeeded"?this.telemetryReporter?.terminal({outcome:"payment_succeeded",provider:"paypal",paymentMethodCategory:"paypal"}):r.status!=="processing"&&(ye(r.error)?this.telemetryReporter?.terminal({outcome:"payment_declined",provider:"paypal",paymentMethodCategory:"paypal"}):r.error?.type==="validation_error"?this.telemetryReporter?.terminal({outcome:"validation_rejected",provider:"paypal",paymentMethodCategory:"paypal"}):r.error&&this.telemetryReporter?.error({errorCode:"PAYMENT_PROCESSING_FAILED",stage:"processing",provider:"paypal",paymentMethodCategory:"paypal",requestCategory:"intent_create"})),r}catch(r){throw this.telemetryReporter?.performance({stage:"processing",durationMs:this.now()-t,durationMode:"machine",provider:"paypal",paymentMethodCategory:"paypal"}),this.telemetryReporter?.error({errorCode:"NETWORK_REQUEST_FAILED",stage:"processing",provider:"paypal",paymentMethodCategory:"paypal",requestCategory:"intent_create",statusClass:"network_error"}),r}}async resumePayPalPayment(){let e=this.now();try{let t=await this.provider.resumePayPalPayment();return t===null?null:(this.telemetryReporter?.log({name:"provider.redirect.resumed",stage:"redirect_resume",provider:"paypal",paymentMethodCategory:"paypal"}),this.telemetryReporter?.performance({stage:"redirect_resume",durationMs:this.now()-e,durationMode:"machine",provider:"paypal",paymentMethodCategory:"paypal"}),t.status==="succeeded"?this.telemetryReporter?.terminal({outcome:"payment_succeeded",provider:"paypal",paymentMethodCategory:"paypal"}):ye(t.error)?this.telemetryReporter?.terminal({outcome:"payment_declined",provider:"paypal",paymentMethodCategory:"paypal"}):t.error?.type==="validation_error"?this.telemetryReporter?.terminal({outcome:"validation_rejected",provider:"paypal",paymentMethodCategory:"paypal"}):t.error&&this.telemetryReporter?.error({errorCode:"REDIRECT_RESUME_FAILED",stage:"redirect_resume",provider:"paypal",paymentMethodCategory:"paypal"}),t)}catch(t){throw this.telemetryReporter?.performance({stage:"redirect_resume",durationMs:this.now()-e,durationMode:"machine",provider:"paypal",paymentMethodCategory:"paypal"}),this.telemetryReporter?.error({errorCode:"REDIRECT_RESUME_FAILED",stage:"redirect_resume",provider:"paypal",paymentMethodCategory:"paypal"}),t}}async confirmPayment(e){if(e.paymentMethodCategory!=="wallet"&&e.paymentMethodCategory!=="apm"||!e.paymentMethodType?.trim()||e.paymentMethodType.trim().toLowerCase()==="card")throw new w.FloPayError("A supported non-card payment method is required.","validation_error",{param:"paymentMethodType"});let t=this.now(),r=bt(this.provider.name);this.telemetryReporter?.log({name:"payment.processing.started",stage:"processing",provider:r,paymentMethodCategory:e.paymentMethodCategory});try{let s=await this.provider.confirmPayment(e),o=this.now()-t;return this.telemetryReporter?.performance({stage:"processing",durationMs:o,durationMode:"machine",provider:r,paymentMethodCategory:e.paymentMethodCategory}),s.status==="succeeded"?this.telemetryReporter?.terminal({outcome:"payment_succeeded",provider:r,paymentMethodCategory:e.paymentMethodCategory}):ye(s.error)?this.telemetryReporter?.terminal({outcome:"payment_declined",provider:r,paymentMethodCategory:e.paymentMethodCategory}):s.error?.type==="validation_error"?this.telemetryReporter?.terminal({outcome:"validation_rejected",provider:r,paymentMethodCategory:e.paymentMethodCategory}):s.status==="requires_action"?this.telemetryReporter?.terminal({outcome:"action_required",stage:"three_ds_handoff",provider:r,paymentMethodCategory:e.paymentMethodCategory}):s.status==="failed"&&s.error&&this.telemetryReporter?.error({errorCode:"PAYMENT_PROCESSING_FAILED",stage:"processing",provider:r,paymentMethodCategory:e.paymentMethodCategory}),s.status==="succeeded"||s.status==="failed"?this.telemetryReporter?.log({name:"payment.processing.completed",stage:"processing",provider:r,paymentMethodCategory:e.paymentMethodCategory}):this.telemetryReporter?.log({name:"operation.state_transition",stage:s.status==="requires_action"?"three_ds_handoff":"processing",provider:r,paymentMethodCategory:e.paymentMethodCategory}),s}catch(s){throw this.telemetryReporter?.performance({stage:"processing",durationMs:this.now()-t,durationMode:"machine",provider:r,paymentMethodCategory:e.paymentMethodCategory}),this.telemetryReporter?.error({errorCode:"PAYMENT_PROCESSING_FAILED",stage:"processing",provider:r,paymentMethodCategory:e.paymentMethodCategory}),s}}async retrieveSession(e,t){if(!e)throw new w.FloPayError("sessionId is required to retrieve a session.","validation_error",{param:"sessionId"});let r=await this.retrieveUnifiedSession(e,t);if(!r.data.session)throw new w.FloPayError("Session not found","api_error");return r.data.session}async retrieveUnifiedSession(e,t){if(!e)throw new w.FloPayError("sessionId is required.","validation_error",{param:"sessionId"});let r=(0,w.resolveBillingApiUrl)(t??this.config.billingApiUrl),s=this.now();this.telemetryReporter?.log({name:"session.read.started",stage:"session_read",requestCategory:"session_read"});let o,i=Me(r,{now:()=>this.telemetryReporter?.now()??_(),onFirstByte:a=>{o=a},onRetry:(a,l)=>{this.telemetryReporter?.log({name:"operation.retry",stage:a==="session_read"?"session_read":"processing",requestCategory:a,attempt:l})}});try{let a=await i.getUnifiedCheckoutSession(e);return o!==void 0&&(this.telemetryReporter?.log({name:"session.request.first_byte",stage:"session_first_byte",requestCategory:"session_read",statusClass:"2xx"}),this.telemetryReporter?.performance({stage:"session_first_byte",durationMs:o,durationMode:"machine",requestCategory:"session_read",statusClass:"2xx"})),this.telemetryReporter?.log({name:"session.request.completed",stage:"session_complete",requestCategory:"session_read",statusClass:"2xx"}),this.telemetryReporter?.log({name:"checkout.data.ready",stage:"checkout_data_ready"}),this.telemetryReporter?.performance({stage:"session_complete",durationMs:this.now()-s,durationMode:"machine",requestCategory:"session_read",statusClass:"2xx"}),a}catch(a){let l=a instanceof w.FloPayError?a.statusCode:void 0;throw this.telemetryReporter?.error({errorCode:a instanceof w.FloPayError&&a.code==="checkout_processing_timeout"?"REQUEST_TIMEOUT":"NETWORK_REQUEST_FAILED",stage:"session_read",provider:"flo",paymentMethodCategory:"unknown"}),this.telemetryReporter?.performance({stage:"session_complete",durationMs:this.now()-s,durationMode:"machine",requestCategory:"session_read",statusClass:l?`${Math.floor(l/100)}xx`:"network_error"}),a}}getRawProvider(){return this.provider.getRawProvider()}destroy(){this.telemetryReporter?.log({name:"checkout.unmount",stage:"unmount"}),this.telemetryReporter?.destroy(),this.currentElements?.destroy(),this.currentElements=null,this.provider.destroy()}};function Ne(n,e,t){let r=G;return new r(n,e,t)}var Ve=new Map;function he(n){return Array.isArray(n)?n.map(he):n&&typeof n=="object"?Object.fromEntries(Object.entries(n).filter(([,e])=>e!==void 0).sort(([e],[t])=>e.localeCompare(t)).map(([e,t])=>[e,he(t)])):n}function Et(n,e){return JSON.stringify([n,(0,R.resolveBillingApiUrl)(e?.billingApiUrl),e?.telemetry!==!1,e?.locale??"auto",e?.apiVersion??null,he(e?.appearance??null)])}var se=new Map;async function Ke(n,e){if(!n){let a=new v({billingApiUrl:(0,R.resolveBillingApiUrl)(e?.billingApiUrl),sdkVersion:R.SDK_VERSION,enabled:e?.telemetry!==!1});throw a.error({errorCode:"CONFIGURATION_INVALID",stage:"sdk_initialize",paymentMethodCategory:"unknown"}),a.flush().catch(()=>{}).finally(()=>a.destroy()),new R.FloPayError("A publishable key is required to initialize FloPay.","validation_error",{param:"publishableKey"})}let t=Et(n,e),r=Ve.get(t);if(r)return e?.telemetry!==!1&&Le(r)?.log({name:"sdk.cache.hit",stage:"sdk_initialize"}),r;let s=se.get(t);if(s)return s;let o={...e,publishableKey:n},i=(async()=>{let a=new v({billingApiUrl:(0,R.resolveBillingApiUrl)(o.billingApiUrl),sdkVersion:R.SDK_VERSION,enabled:o.telemetry!==!1}),l=a.now();a.log({name:"sdk.initialize.started",stage:"sdk_initialize"}),a.log({name:"sdk.cache.miss",stage:"sdk_initialize"}),a.log({name:"provider.load.started",stage:"provider_load",provider:"stripe"});let c=new K;try{await c.initialize(o)}catch(b){throw a.error({errorCode:"SDK_INITIALIZATION_FAILED",stage:"sdk_initialize",provider:"stripe",paymentMethodCategory:"unknown"}),a.destroy(),b}a.log({name:"provider.ready",stage:"provider_ready",provider:"stripe"}),a.log({name:"provider.availability.checked",stage:"provider_ready",provider:"stripe"}),a.log({name:"sdk.initialize.ready",stage:"sdk_initialize"});let u=a.now()-l;a.performance({stage:"sdk_initialize",durationMs:u,durationMode:"machine",provider:"stripe"}),a.performance({stage:"provider_ready",durationMs:u,durationMode:"machine",provider:"stripe"});let y=Ne(c,o,a);return Ve.set(t,y),y})();se.set(t,i);try{return await i}finally{se.get(t)===i&&se.delete(t)}}var m=require("@flopay/shared");var ge=5;function kt(n,e){let t=e?.error,r=I(e?.code)??I(t?.code)??`http_${n}`,s=I(e?.message)??I(t?.message)??Mt(r,n);return new m.FloPayError(s,"api_error",{code:r,statusCode:n})}function Mt(n,e){switch(n){case"CouponLimitExceeded":return`Too many coupon codes \u2014 a checkout session accepts at most ${ge}.`;case"CouponCurrencyUnsupported":return"One of the applied coupons has no price configured for the cart currency.";default:return`Failed to create checkout session (HTTP ${e}).`}}async function Be(n,e){let{billingApiUrl:t,checkoutBaseUrl:r,items:s=[],subscriptions:o=[],products:i,account:a,successUrl:l,cancelUrl:c,checkoutMode:u="confirm",couponCodes:y=[],tagsData:b,redirectParams:g={},setCookie:E=!0,timeoutMs:k=12e3,clientId:P,currency:Ce,utmMetadata:O,idempotencyKey:p}=n,z=(0,m.resolveIdempotencyKey)(p);if(y.length>ge)throw new m.FloPayError(`Too many coupon codes \u2014 a checkout session accepts at most ${ge}.`,"validation_error",{code:"CouponLimitExceeded",param:"couponCodes"});let q=i??(0,m.foldIntoProducts)(s,o),S=(0,m.resolveSessionCurrency)(Ce,s,o,q);if(!S)throw new m.FloPayError("currency is required: pass `currency` on the session, or include a `currency` on the first item/subscription/product.","validation_error",{code:"CurrencyRequired",param:"currency"});let j={clientId:P,checkoutVersion:m.SDK_VERSION,successUrl:l,cancelUrl:c,currency:S,checkoutMode:u,products:q.map(M=>(0,m.buildProductPayload)(M,S)),accountData:{userId:a.userId,firstName:a.firstName??null,lastName:a.lastName??null,email:a.email,country:a.country??null,gender:a.gender??null,city:a.city??null,state:a.state??null,zip:a.zip??null,addressLine1:a.addressLine1??null,addressLine2:a.addressLine2??null},couponCodes:y};b&&(j.tagsData=b),O?.length&&(j.utmMetadata=O);let ie=`${t.replace(/\/+$/,"")}/v1/checkouts/sessions`,ve=new AbortController,Ye=setTimeout(()=>ve.abort(),k),Te={"Content-Type":"application/json"};z&&(Te[m.IDEMPOTENCY_KEY_HEADER]=z);let U,W;try{let M=await fetch(ie,{method:"POST",headers:Te,body:JSON.stringify(j),signal:ve.signal});try{e?.(M.status)}catch{}U=M.status;try{W=await M.json()}catch{}}finally{clearTimeout(Ye)}if(U>=400)throw kt(U,W);if(U===201){let M=W?.data?.uuid,ae=W?.data?.nonce;if(!M)throw new Error("Checkout session created but no UUID was returned by the billing API");if(!ae)throw new m.FloPayError("Checkout session created but no `nonce` was returned by the billing API. Upgrade the billing service to TeamFloPay/backend#640 or later.","api_error",{code:"MissingCheckoutSessionToken"});(q.length||S)&&x(M,{currency:S,products:q.map(f=>({code:f.code??f.providerItemId??f.providerPlanId,type:f.type,name:f.name??f.itemName??f.providerItemName??f.subscriptionName??f.providerPlanName??null,totalAmount:f.totalAmount,overrideAmount:f.overrideAmount,currency:f.currency??S}))});let Q=new URL(`${r.replace(/\/+$/,"")}/secure`);Q.searchParams.set("id",M);for(let[f,J]of Object.entries(g))Q.searchParams.set(f,J);if(E&&typeof window<"u"&&typeof document<"u"){let f=JSON.stringify({origin_url:c}),J=window.location.hostname.split(".").slice(-2).join(".");document.cookie=`checkout_data=${encodeURIComponent(f)}; domain=.${J}; path=/; max-age=3600; SameSite=Lax; Secure;`,document.cookie=`flopay_checkout_token=${encodeURIComponent(ae)}; domain=.${J}; path=/; max-age=3600; SameSite=Lax; Secure;`}return typeof window<"u"&&(window.location.href=Q.toString()),{status:201,redirectUrl:Q.toString(),nonce:ae}}return U===204?(typeof window<"u"&&(window.location.href=l),{status:204}):{status:U}}async function ze(n){let e=He(n),t=je(e);try{let r=await Be(n,t);return $e(e,r),r}catch(r){throw fe(e.reporter,r),r}finally{Y(e.reporter)}}function je(n){let e=!1;return t=>{if(e)return;e=!0;let r=`${Math.floor(t/100)}xx`;n.reporter.log({name:"session.request.first_byte",stage:"session_first_byte",requestCategory:"session_create",statusClass:r}),n.reporter.performance({stage:"session_first_byte",durationMs:n.reporter.now()-n.startedAt,durationMode:"machine",requestCategory:"session_create",statusClass:r})}}function He(n){let e=new v({billingApiUrl:n.billingApiUrl,sdkVersion:m.SDK_VERSION,enabled:n.telemetry!==!1}),t=e.now();return e.log({name:"session.create.started",stage:"session_create",requestCategory:"session_create"}),{reporter:e,startedAt:t}}function $e(n,e){let t=`${Math.floor(e.status/100)}xx`;n.reporter.log({name:"session.request.completed",stage:"session_complete",requestCategory:"session_create",statusClass:t}),n.reporter.performance({stage:"session_complete",durationMs:n.reporter.now()-n.startedAt,durationMode:"machine",requestCategory:"session_create",statusClass:t})}function fe(n,e){if(e instanceof m.FloPayError&&e.type==="validation_error"){n.terminal({outcome:"validation_rejected",stage:"session_create",requestCategory:"session_create"});return}let t=e instanceof m.FloPayError?e.statusCode:void 0;n.error({errorCode:e instanceof Error&&e.name==="AbortError"?"REQUEST_TIMEOUT":e instanceof TypeError?"NETWORK_REQUEST_FAILED":"CHECKOUT_SESSION_CREATE_FAILED",stage:"session_create",requestCategory:"session_create",statusClass:e instanceof Error&&e.name==="AbortError"?"timeout":t?`${Math.floor(t/100)}xx`:"network_error"})}function Y(n){n.flush().catch(()=>{}).finally(()=>n.destroy())}async function Ge(n){let{maxRetries:e=3,...t}=n,r=He(n),s=je(r);if(!Number.isFinite(e)||!Number.isInteger(e)||e<=0)throw r.reporter.terminal({outcome:"validation_rejected",stage:"session_create",requestCategory:"session_create"}),Y(r.reporter),new Error("Number of retries must be greater than 0");let o={...t,idempotencyKey:(0,m.resolveIdempotencyKey)(t.idempotencyKey)},i;for(let a=0;a<=e;a++)try{let l=await Be(o,s);return $e(r,l),Y(r.reporter),l}catch(l){i=l;let c=l instanceof Error&&l.name==="AbortError",u=l instanceof m.FloPayError&&l.code===m.IDEMPOTENCY_IN_PROGRESS_CODE;if((c||u)&&a<e){r.reporter.log({name:"operation.retry",stage:"session_create",requestCategory:"session_create",attempt:a+1}),await new Promise(y=>setTimeout(y,100*Math.pow(2,a)));continue}throw fe(r.reporter,l),Y(r.reporter),l}throw fe(r.reporter,i),Y(r.reporter),i??new Error("Unknown error during checkout session creation")}0&&(module.exports={FloPay,FloPayElements,PaymentAPI,PciVaultCardCapture,StripeAdapter,cacheSessionDisplayData,clearSessionDisplayData,createCheckoutSession,createCheckoutSessionWithRetries,getSessionDisplayData,loadFloPay});