@networksolution/sia-vpos-node 1.0.0 → 1.2.0

package/dist/vpos-client.js

@@ -1,8 +1,12 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VposClient = void 0;
 exports.generateTimestamp = generateTimestamp;
 exports.generateReqRefNum = generateReqRefNum;
+const crypto_js_1 = __importDefault(require("crypto-js"));
 const mac_1 = require("./mac");
 const xml_1 = require("./xml");
 // ─── Defaults ────────────────────────────────────────────────────────────────
@@ -10,20 +14,31 @@ const API_URLS = {
     production: 'https://virtualpos.sia.eu/vpos/apibo/apiBOXML-UTF8.app',
     test: 'https://virtualpostest.sia.eu/vpos/apibo/apiBOXML-UTF8.app',
 };
+const REDIRECT_URLS = {
+    production: 'https://virtualpos.sia.eu/vpos/payments/main',
+    test: 'https://virtualpostest.sia.eu/vpos/payments/main',
+};
 const DEFAULT_RELEASE = '02';
 const DEFAULT_CURRENCY = '978'; // EUR
 const DEFAULT_EXPONENT = '2';
+function resolveEnvironment(config) {
+    return config.environment
+        || (typeof process !== 'undefined' && process.env?.VPOS_ENV)
+        || 'test';
+}
 /**
- * Resolve the environment from config or VPOS_ENV env variable.
+ * Resolve the API URL from config or VPOS_ENV env variable.
  * Priority: config.apiUrl > config.environment > VPOS_ENV > 'test' (default)
  */
 function resolveApiUrl(config) {
     if (config.apiUrl)
         return config.apiUrl;
-    const env = config.environment
-        || (typeof process !== 'undefined' && process.env?.VPOS_ENV)
-        || 'test';
-    return API_URLS[env] || API_URLS.test;
+    return API_URLS[resolveEnvironment(config)] || API_URLS.test;
+}
+function resolveRedirectUrl(config) {
+    if (config.redirectUrl)
+        return config.redirectUrl;
+    return REDIRECT_URLS[resolveEnvironment(config)] || REDIRECT_URLS.test;
 }
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 /**
@@ -56,15 +71,16 @@ function generateReqRefNum(date) {
 // ─── Main Client ─────────────────────────────────────────────────────────────
 class VposClient {
     constructor(config) {
-        const environment = config.environment
-            || (typeof process !== 'undefined' && process.env?.VPOS_ENV)
-            || 'test';
+        const environment = resolveEnvironment(config);
         this.config = {
             shopId: config.shopId,
             operatorId: config.operatorId,
             secretKey: config.secretKey,
+            startKey: config.startKey || config.secretKey,
+            apiResultKey: config.apiResultKey || config.secretKey,
             hashAlgorithm: config.hashAlgorithm || 'hmac-sha256',
             apiUrl: resolveApiUrl(config),
+            redirectUrl: resolveRedirectUrl(config),
             environment,
             release: config.release || DEFAULT_RELEASE,
         };
@@ -81,6 +97,10 @@ class VposClient {
     get apiUrl() {
         return this.config.apiUrl;
     }
+    /** Returns the current Redirect URL */
+    get redirectUrl() {
+        return this.config.redirectUrl;
+    }
     // ── Internal: send XML request to VPOS ──────────────────────────────────────
     async sendRequest(xml) {
         const body = `data=${encodeURIComponent(xml)}`;
@@ -525,6 +545,104 @@ class VposClient {
         };
     }
     // ══════════════════════════════════════════════════════════════════════════════
+    //  LISTOPERATION (Consultation: list operations by date range)
+    // ══════════════════════════════════════════════════════════════════════════════
+    async listOperations(data) {
+        const timestamp = generateTimestamp();
+        const reqRefNum = generateReqRefNum();
+        // MAC fields per spec 4.2.4
+        const macFields = [
+            ['OPERATION', 'LISTOPERATION'],
+            ['TIMESTAMP', timestamp],
+            ['SHOPID', this.config.shopId],
+            ['OPERATORID', this.config.operatorId],
+            ['REQREFNUM', reqRefNum],
+            ['STARTDATE', data.startDate],
+            ['ENDDATE', data.endDate],
+            ['OPDESCR', data.opDescr],
+            ['OPTIONS', data.options],
+        ];
+        const mac = (0, mac_1.generateMAC)(macFields, this.config.secretKey, this.config.hashAlgorithm);
+        const dataXml = [
+            '<ListOperation>',
+            (0, xml_1.buildHeaderXml)(this.config.shopId, this.config.operatorId, reqRefNum),
+            (0, xml_1.el)('StartDate', data.startDate),
+            (0, xml_1.el)('EndDate', data.endDate),
+            (0, xml_1.el)('SrcType', data.srcType),
+            (0, xml_1.el)('OpDescr', data.opDescr),
+            '</ListOperation>',
+        ].filter(Boolean).join('\n');
+        const xml = (0, xml_1.buildBPWXmlRequest)({
+            release: this.config.release,
+            operation: 'LISTOPERATION',
+            timestamp,
+            mac,
+            dataXml,
+        });
+        const responseXml = await this.sendRequest(xml);
+        const parsed = (0, xml_1.parseBPWXmlResponse)(responseXml);
+        return {
+            ...parsed,
+            numberOfItems: parsed.data ? (0, xml_1.getXmlValue)(parsed.data, 'NumberOfItems') : undefined,
+            operations: parsed.data ? (0, xml_1.parseOperationList)(parsed.data) : [],
+        };
+    }
+    // ══════════════════════════════════════════════════════════════════════════════
+    //  LISTAUTHORIZATION (Consultation: list authorizations by filter)
+    // ══════════════════════════════════════════════════════════════════════════════
+    async listAuthorizations(data) {
+        const timestamp = generateTimestamp();
+        const reqRefNum = generateReqRefNum();
+        // MAC fields per spec 4.2.5 — TRANSACTIONID must ALWAYS be included (even empty)
+        // STARTTIME/ENDTIME only included when searching by time
+        const macParts = [
+            `OPERATION=LISTAUTHORIZATION`,
+            `TIMESTAMP=${timestamp}`,
+            `SHOPID=${this.config.shopId}`,
+            `OPERATORID=${this.config.operatorId}`,
+            `REQREFNUM=${reqRefNum}`,
+        ];
+        if (data.startDate)
+            macParts.push(`STARTDATE=${data.startDate}`);
+        if (data.endDate)
+            macParts.push(`ENDDATE=${data.endDate}`);
+        macParts.push(`FILTER=${data.filter}`);
+        macParts.push(`TRANSACTIONID=${data.transactionId || ''}`);
+        if (data.startTime)
+            macParts.push(`STARTTIME=${data.startTime}`);
+        if (data.endTime)
+            macParts.push(`ENDTIME=${data.endTime}`);
+        if (data.options)
+            macParts.push(`OPTIONS=${data.options}`);
+        const macString = macParts.join('&');
+        const mac = (0, mac_1.computeHash)(macString, this.config.secretKey, this.config.hashAlgorithm);
+        const dataXml = [
+            '<ListAuthorization>',
+            (0, xml_1.buildHeaderXml)(this.config.shopId, this.config.operatorId, reqRefNum),
+            (0, xml_1.el)('StartDate', data.startDate),
+            (0, xml_1.el)('EndDate', data.endDate),
+            (0, xml_1.el)('Filter', data.filter),
+            (0, xml_1.el)('TransactionID', data.transactionId),
+            (0, xml_1.el)('StartTime', data.startTime),
+            (0, xml_1.el)('EndTime', data.endTime),
+            '</ListAuthorization>',
+        ].filter(Boolean).join('\n');
+        const xml = (0, xml_1.buildBPWXmlRequest)({
+            release: this.config.release,
+            operation: 'LISTAUTHORIZATION',
+            timestamp,
+            mac,
+            dataXml,
+        });
+        const responseXml = await this.sendRequest(xml);
+        const parsed = (0, xml_1.parseBPWXmlResponse)(responseXml);
+        return {
+            ...parsed,
+            numberOfItems: parsed.data ? (0, xml_1.getXmlValue)(parsed.data, 'NumberOfItems') : undefined,
+            authorizations: parsed.data ? (0, xml_1.parseAuthorizationList)(parsed.data) : [],
+        };
+    }
+    // ══════════════════════════════════════════════════════════════════════════════
     //  WEBHOOK VERIFICATION
     // ══════════════════════════════════════════════════════════════════════════════
     /**
@@ -603,6 +721,358 @@ class VposClient {
             linkCreated: parsed.data ? (0, xml_1.parseLinkCreated)(parsed.data) : undefined,
         };
     }
+    // ══════════════════════════════════════════════════════════════════════════════
+    //  REDIRECT: Build Payment Form (4.2.1)
+    // ══════════════════════════════════════════════════════════════════════════════
+    /**
+     * Build redirect form data for standard payment initiation.
+     * Returns URL, form fields, and pre-built HTML.
+     * The customer's browser should POST this form to SIA VPOS.
+     */
+    buildRedirectForm(data) {
+        const exponent = data.exponent || DEFAULT_EXPONENT;
+        // MAC fields per spec 5.2.1 — order is critical!
+        const macFields = [
+            ['URLMS', data.urlMs],
+            ['URLDONE', data.urlDone],
+            ['ORDERID', data.orderId],
+            ['SHOPID', this.config.shopId],
+            ['AMOUNT', data.amount],
+            ['CURRENCY', data.currency],
+            ['EXPONENT', data.exponent], // only if present
+            ['ACCOUNTINGMODE', data.accountingMode],
+            ['AUTHORMODE', data.authorMode],
+            ['OPTIONS', data.options],
+            ['NAME', data.name],
+            ['SURNAME', data.surname],
+            ['TAXID', data.taxId],
+            ['LOCKCARD', data.lockCard],
+            ['COMMIS', data.commis],
+            ['ORDDESCR', data.ordDescr],
+            ['VSID', data.vsid],
+            ['OPDESCR', data.opDescr],
+            ['REMAININGDURATION', data.remainingDuration],
+            ['USERID', data.userId],
+            ['PHONENUMBER', data.phoneNumber],
+            ['CAUSATION', data.causation],
+            ['USER', data.user],
+            ['PRODUCTREF', data.productRef],
+            ['ANTIFRAUD', data.antifraud],
+            ['3DSDATA', data.threeDsData],
+            ['TRECURR', data.tRecurr],
+            ['URLMSHEADER', data.urlMsHeader],
+            ['INSTALLMENTSNUMBER', data.installmentsNumber],
+            ['TICKLERPLAN', data.ticklerPlan],
+        ];
+        const mac = (0, mac_1.generateMAC)(macFields, this.config.startKey, this.config.hashAlgorithm);
+        // Build form fields (all uppercase, case sensitive per spec)
+        const fields = {
+            PAGE: 'LAND',
+            AMOUNT: String(data.amount),
+            CURRENCY: data.currency,
+            ORDERID: data.orderId,
+            SHOPID: this.config.shopId,
+            URLBACK: data.urlBack,
+            URLDONE: data.urlDone,
+            URLMS: data.urlMs,
+            ACCOUNTINGMODE: data.accountingMode,
+            AUTHORMODE: data.authorMode,
+            MAC: mac,
+        };
+        // Add optional fields
+        const optionals = [
+            ['URLMSHEADER', data.urlMsHeader],
+            ['LANG', data.lang],
+            ['SHOPEMAIL', data.shopEmail],
+            ['OPTIONS', data.options],
+            ['LOCKCARD', data.lockCard],
+            ['EMAIL', data.email],
+            ['ORDDESCR', data.ordDescr],
+            ['VSID', data.vsid],
+            ['OPDESCR', data.opDescr],
+            ['REMAININGDURATION', data.remainingDuration],
+            ['USERID', data.userId],
+            ['PHONENUMBER', data.phoneNumber],
+            ['CAUSATION', data.causation],
+            ['USER', data.user],
+            ['NAME', data.name],
+            ['SURNAME', data.surname],
+            ['TAXID', data.taxId],
+            ['PRODUCTREF', data.productRef],
+            ['ANTIFRAUD', data.antifraud],
+            ['3DSDATA', data.threeDsData],
+            ['TRECURR', data.tRecurr],
+            ['INSTALLMENTSNUMBER', data.installmentsNumber],
+            ['TICKLERPLAN', data.ticklerPlan],
+            ['EXPONENT', data.exponent],
+            ['COMMIS', data.commis],
+        ];
+        for (const [key, value] of optionals) {
+            if (value !== undefined && value !== null && value !== '') {
+                fields[key] = String(value);
+            }
+        }
+        const url = this.config.redirectUrl;
+        const html = buildHtmlForm(url, fields);
+        return { url, fields, html };
+    }
+    // ══════════════════════════════════════════════════════════════════════════════
+    //  REDIRECT: Build Token Payment Form (4.2.4)
+    // ══════════════════════════════════════════════════════════════════════════════
+    /**
+     * Build redirect form data for token-based payment (saved card / pan alias).
+     * Returns URL, form fields, and pre-built HTML.
+     */
+    buildTokenRedirectForm(data) {
+        // MAC fields per spec 5.2.3 — same as 5.2.1 but adds TOKEN, EXPDATE, NETWORK, IBAN at end
+        const macFields = [
+            ['URLMS', data.urlMs],
+            ['URLDONE', data.urlDone],
+            ['ORDERID', data.orderId],
+            ['SHOPID', this.config.shopId],
+            ['AMOUNT', data.amount],
+            ['CURRENCY', data.currency],
+            ['EXPONENT', data.exponent],
+            ['ACCOUNTINGMODE', data.accountingMode],
+            ['AUTHORMODE', data.authorMode],
+            ['OPTIONS', data.options],
+            ['NAME', data.name],
+            ['SURNAME', data.surname],
+            ['TAXID', data.taxId],
+            ['LOCKCARD', data.lockCard],
+            ['COMMIS', data.commis],
+            ['ORDDESCR', data.ordDescr],
+            ['VSID', data.vsid],
+            ['OPDESCR', data.opDescr],
+            ['REMAININGDURATION', data.remainingDuration],
+            ['USERID', data.userId],
+            ['PHONENUMBER', data.phoneNumber],
+            ['CAUSATION', data.causation],
+            ['USER', data.user],
+            ['PRODUCTREF', data.productRef],
+            ['ANTIFRAUD', data.antifraud],
+            ['3DSDATA', data.threeDsData],
+            ['TRECURR', data.tRecurr],
+            ['CRECURR', data.cRecurr],
+            ['URLMSHEADER', data.urlMsHeader],
+            ['INSTALLMENTSNUMBER', data.installmentsNumber],
+            ['TICKLERPLAN', data.ticklerPlan],
+            ['TOKEN', data.token],
+            ['EXPDATE', data.expDate],
+            ['NETWORK', data.network],
+            ['IBAN', data.iban],
+        ];
+        const mac = (0, mac_1.generateMAC)(macFields, this.config.startKey, this.config.hashAlgorithm);
+        const fields = {
+            PAGE: 'TOKEN',
+            AMOUNT: String(data.amount),
+            CURRENCY: data.currency,
+            ORDERID: data.orderId,
+            SHOPID: this.config.shopId,
+            URLBACK: data.urlBack,
+            URLDONE: data.urlDone,
+            URLMS: data.urlMs,
+            ACCOUNTINGMODE: data.accountingMode,
+            AUTHORMODE: data.authorMode,
+            TOKEN: data.token,
+            NETWORK: data.network,
+            TRECURR: data.tRecurr || 'C',
+            MAC: mac,
+        };
+        // Optional fields
+        const optionals = [
+            ['URLMSHEADER', data.urlMsHeader],
+            ['LANG', data.lang],
+            ['SHOPEMAIL', data.shopEmail],
+            ['OPTIONS', data.options],
+            ['EMAIL', data.email],
+            ['ORDDESCR', data.ordDescr],
+            ['VSID', data.vsid],
+            ['OPDESCR', data.opDescr],
+            ['REMAININGDURATION', data.remainingDuration],
+            ['USERID', data.userId],
+            ['PHONENUMBER', data.phoneNumber],
+            ['CAUSATION', data.causation],
+            ['USER', data.user],
+            ['NAME', data.name],
+            ['SURNAME', data.surname],
+            ['TAXID', data.taxId],
+            ['PRODUCTREF', data.productRef],
+            ['ANTIFRAUD', data.antifraud],
+            ['3DSDATA', data.threeDsData],
+            ['INSTALLMENTSNUMBER', data.installmentsNumber],
+            ['TICKLERPLAN', data.ticklerPlan],
+            ['EXPONENT', data.exponent],
+            ['COMMIS', data.commis],
+            ['EXPDATE', data.expDate],
+            ['CRECURR', data.cRecurr],
+            ['IBAN', data.iban],
+        ];
+        for (const [key, value] of optionals) {
+            if (value !== undefined && value !== null && value !== '') {
+                fields[key] = String(value);
+            }
+        }
+        const url = this.config.redirectUrl;
+        const html = buildHtmlForm(url, fields);
+        return { url, fields, html };
+    }
+    // ══════════════════════════════════════════════════════════════════════════════
+    //  REDIRECT: Parse Outcome (4.2.3)
+    // ══════════════════════════════════════════════════════════════════════════════
+    /**
+     * Parse URLMS or URLDONE query string parameters into a typed object.
+     * Accepts a full URL string, a query string, or URLSearchParams.
+     */
+    parseOutcomeParams(input) {
+        let params;
+        if (typeof input === 'string') {
+            const qIdx = input.indexOf('?');
+            params = new URLSearchParams(qIdx >= 0 ? input.substring(qIdx + 1) : input);
+        }
+        else {
+            params = input;
+        }
+        const g = (key) => params.get(key) || '';
+        return {
+            orderId: g('ORDERID'),
+            shopId: g('SHOPID'),
+            authNumber: g('AUTHNUMBER'),
+            amount: g('AMOUNT'),
+            currency: g('CURRENCY'),
+            transactionId: g('TRANSACTIONID'),
+            accountingMode: g('ACCOUNTINGMODE'),
+            authorMode: g('AUTHORMODE'),
+            result: g('RESULT'),
+            transactionType: g('TRANSACTIONTYPE') || undefined,
+            network: g('NETWORK') || undefined,
+            mac: g('MAC'),
+            // Optional fields
+            issuerCountry: g('ISSUERCOUNTRY') || undefined,
+            authCode: g('AUTHCODE') || undefined,
+            payerId: g('PAYERID') || undefined,
+            payer: g('PAYER') || undefined,
+            payerStatus: g('PAYERSTATUS') || undefined,
+            hashPan: g('HASHPAN') || undefined,
+            panAlias: g('PANALIAS') || undefined,
+            panAliasRev: g('PANALIASREV') || undefined,
+            panAliasExpDate: g('PANALIASEXPDATE') || undefined,
+            panAliasTail: g('PANALIASTAIL') || undefined,
+            maskedPan: g('MASKEDPAN') || undefined,
+            tRecurr: g('TRECURR') || undefined,
+            cRecurr: g('CRECURR') || undefined,
+            panTail: g('PANTAIL') || undefined,
+            panExpiryDate: g('PANEXPIRYDATE') || undefined,
+            accountHolder: g('ACCOUNTHOLDER') || undefined,
+            iban: g('IBAN') || undefined,
+            aliasStr: g('ALIASSTR') || undefined,
+            ahEmail: g('AHEMAIL') || undefined,
+            ahTaxId: g('AHTAXID') || undefined,
+            acquirerBin: g('ACQUIRERBIN') || undefined,
+            merchantId: g('MERCHANTID') || undefined,
+            cardType: g('CARDTYPE') || undefined,
+            amazonAuthId: g('AMAZONAUTHID') || undefined,
+            amazonCaptureId: g('AMAZONCAPTUREID') || undefined,
+            chInfo: g('CHINFO') || undefined,
+            panCode: g('PANCODE') || undefined,
+            installmentsNumber: g('INSTALLMENTSNUMBER') || undefined,
+            cardholderData: g('CARDHOLDERDATA') || undefined,
+            threeDsResult: g('THREEDSRESULT') || undefined,
+            subscriptionCode: g('SUBSCRIPTIONCODE') || undefined,
+        };
+    }
+    // ══════════════════════════════════════════════════════════════════════════════
+    //  REDIRECT: Verify Outcome MAC (5.2.2)
+    // ══════════════════════════════════════════════════════════════════════════════
+    /**
+     * Verify the MAC of a redirect outcome (URLMS/URLDONE) using the API-Result key.
+     * Per spec 5.2.2: MAC is NULL if result is negative (unless OPTION R).
+     * Returns true if MAC is valid, false otherwise.
+     */
+    verifyOutcomeMAC(outcome) {
+        // If MAC is NULL and result is not 00, it's expected (unless OPTION R)
+        if (!outcome.mac || outcome.mac === 'NULL') {
+            return outcome.result !== '00';
+        }
+        // Build MAC string per spec 5.2.2 — field order is critical
+        // Required fields always present:
+        const macFields = [
+            ['ORDERID', outcome.orderId],
+            ['SHOPID', outcome.shopId],
+            ['AUTHNUMBER', outcome.authNumber],
+            ['AMOUNT', outcome.amount],
+            ['CURRENCY', outcome.currency],
+            ['TRANSACTIONID', outcome.transactionId],
+            ['ACCOUNTINGMODE', outcome.accountingMode],
+            ['AUTHORMODE', outcome.authorMode],
+            ['RESULT', outcome.result],
+            ['TRANSACTIONTYPE', outcome.transactionType],
+            // Conditional fields — only included if present in the response
+            ['ISSUERCOUNTRY', outcome.issuerCountry],
+            ['AUTHCODE', outcome.authCode],
+            ['PAYERID', outcome.payerId],
+            ['PAYER', outcome.payer],
+            ['PAYERSTATUS', outcome.payerStatus],
+            ['HASHPAN', outcome.hashPan],
+            ['PANALIASREV', outcome.panAliasRev],
+            ['PANALIAS', outcome.panAlias],
+            ['PANALIASEXPDATE', outcome.panAliasExpDate],
+            ['PANALIASTAIL', outcome.panAliasTail],
+            ['MASKEDPAN', outcome.maskedPan],
+            ['TRECURR', outcome.tRecurr],
+            ['CRECURR', outcome.cRecurr],
+            ['PANTAIL', outcome.panTail],
+            ['PANEXPIRYDATE', outcome.panExpiryDate],
+            ['ACCOUNTHOLDER', outcome.accountHolder],
+            ['IBAN', outcome.iban],
+            ['ALIASSTR', outcome.aliasStr],
+            ['AHEMAIL', outcome.ahEmail],
+            ['AHTAXID', outcome.ahTaxId],
+            ['ACQUIRERBIN', outcome.acquirerBin],
+            ['MERCHANTID', outcome.merchantId],
+            ['CARDTYPE', outcome.cardType],
+            ['AMAZONAUTHID', outcome.amazonAuthId],
+            ['AMAZONCAPTUREID', outcome.amazonCaptureId],
+            ['CHINFO', outcome.chInfo],
+            ['PANCODE', outcome.panCode],
+            ['INSTALLMENTSNUMBER', outcome.installmentsNumber],
+            ['CARDHOLDERDATA', outcome.cardholderData],
+            ['THREEDSRESULT', outcome.threeDsResult],
+            ['SUBSCRIPTIONCODE', outcome.subscriptionCode],
+        ];
+        const computed = (0, mac_1.generateMAC)(macFields, this.config.apiResultKey, this.config.hashAlgorithm);
+        return computed.toLowerCase() === outcome.mac.toLowerCase();
+    }
+    // ══════════════════════════════════════════════════════════════════════════════
+    //  3DS DATA ENCRYPTION (spec 5.4)
+    // ══════════════════════════════════════════════════════════════════════════════
+    /**
+     * Encrypt 3DS 2.0 data for use in the 3DSDATA redirect field.
+     * Uses AES/CBC/PKCS5Padding with first 16 bytes of API secret key, IV = 0.
+     * Input: JSON object with 3DS fields. Output: Base64 string.
+     */
+    encrypt3DSData(data) {
+        const json = JSON.stringify(data);
+        const keyBytes = crypto_js_1.default.enc.Utf8.parse(this.config.apiResultKey.substring(0, 16));
+        const iv = crypto_js_1.default.lib.WordArray.create(new Uint8Array(16));
+        const encrypted = crypto_js_1.default.AES.encrypt(crypto_js_1.default.enc.Utf8.parse(json), keyBytes, { iv, mode: crypto_js_1.default.mode.CBC, padding: crypto_js_1.default.pad.Pkcs7 });
+        return encrypted.ciphertext.toString(crypto_js_1.default.enc.Base64);
+    }
 }
 exports.VposClient = VposClient;
+// ─── Helper: Build HTML Form ──────────────────────────────────────────────────
+function buildHtmlForm(url, fields) {
+    const inputs = Object.entries(fields)
+        .map(([name, value]) => {
+        const escaped = value.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;');
+        return `  <input type="hidden" name="${name}" value="${escaped}">`;
+    })
+        .join('\n');
+    return [
+        `<form id="vpos-redirect-form" method="POST" action="${url}">`,
+        inputs,
+        '  <button type="submit">Proceed to payment</button>',
+        '</form>',
+    ].join('\n');
+}
 //# sourceMappingURL=vpos-client.js.map