@staxpayments/staxpayments-js 2.30.18

package/dist/client.js

@@ -0,0 +1,972 @@
+"use strict";
+
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.StaxPaymentsCredentials = exports.StaxPaymentsBaseClient = exports.StaxApiCredentials = exports.SignatureFormat = exports.RoundingMode = exports.PromptType = exports.HealthcareType = exports.CardType = exports.CVMType = exports.AVSResponse = void 0;
+var _regenerator = _interopRequireDefault(require("@babel/runtime/regenerator"));
+var _toConsumableArray2 = _interopRequireDefault(require("@babel/runtime/helpers/toConsumableArray"));
+var _defineProperty2 = _interopRequireDefault(require("@babel/runtime/helpers/defineProperty"));
+var _asyncToGenerator2 = _interopRequireDefault(require("@babel/runtime/helpers/asyncToGenerator"));
+var _classCallCheck2 = _interopRequireDefault(require("@babel/runtime/helpers/classCallCheck"));
+var _createClass2 = _interopRequireDefault(require("@babel/runtime/helpers/createClass"));
+var _axios = _interopRequireDefault(require("axios"));
+var _cryptoutils = _interopRequireDefault(require("./cryptoutils"));
+var _https = _interopRequireDefault(require("https"));
+var _httpsBrowserify = _interopRequireDefault(require("https-browserify"));
+var _aesJs = _interopRequireDefault(require("aes-js"));
+var _sha = require("@noble/hashes/sha256");
+var _utils = require("@noble/hashes/utils");
+/**
+ * Copyright 2019-2026 BlockChyp, Inc. All rights reserved. Use of this code is governed
+ * by a license that can be found in the LICENSE file.
+ *
+ * This file was generated automatically by the BlockChyp SDK Generator. Changes to this
+ * file will be lost every time the code is regenerated.
+ */
+
+// optionalNodeModule resolves a Node built-in at run time, returning undefined
+// in the browser. The name is held in a variable so the browser bundler cannot
+// statically resolve it and try to shim it into the bundle.
+function optionalNodeModule(name) {
+  try {
+    if (typeof module !== 'undefined' && typeof module.require === 'function') {
+      return module.require(name);
+    }
+  } catch (e) {
+    // Not running under Node.
+  }
+  return undefined;
+}
+
+/* eslint-disable no-unused-vars */
+var CardType = exports.CardType = Object.freeze({
+  CREDIT: 0,
+  DEBIT: 1,
+  EBT: 2,
+  BLOCKCHAIN_GIFT: 3,
+  HEALTHCARE: 4
+});
+var SignatureFormat = exports.SignatureFormat = Object.freeze({
+  NONE: '',
+  PNG: 'png',
+  JPG: 'jpg',
+  GIF: 'gif'
+});
+var RoundingMode = exports.RoundingMode = Object.freeze({
+  UP: 'up',
+  NEAREST: 'nearest',
+  DOWN: 'down'
+});
+var PromptType = exports.PromptType = Object.freeze({
+  AMOUNT: 'amount',
+  EMAIL: 'email',
+  PHONE_NUMBER: 'phone',
+  CUSTOMER_NUMBER: 'customer-number',
+  REWARDS_NUMBER: 'rewards-number',
+  FIRST_NAME: 'first-name',
+  LAST_NAME: 'last-name'
+});
+var AVSResponse = exports.AVSResponse = Object.freeze({
+  NOT_APPLICABLE: '',
+  NOT_SUPPORTED: 'not_supported',
+  RETRY: 'retry',
+  NO_MATCH: 'no_match',
+  ADDRESS_MATCH: 'address_match',
+  POSTAL_CODE_MATCH: 'zip_match',
+  ADDRESS_AND_POSTAL_CODE_MATCH: 'match'
+});
+var CVMType = exports.CVMType = Object.freeze({
+  SIGNATURE: 'Signature',
+  OFFLINE_PIN: 'Offline PIN',
+  ONLINE_PIN: 'Online PIN',
+  CDCVM: 'CDCVM',
+  NO_CVM: 'No CVM'
+});
+var HealthcareType = exports.HealthcareType = Object.freeze({
+  HEALTHCARE: 'healthcare',
+  PRESCRIPTION: 'prescription',
+  VISION: 'vision',
+  CLINIC: 'clinic',
+  DENTAL: 'dental'
+});
+/* eslint-enable no-unused-vars */
+
+var VERSION = require('../package.json').version;
+var USER_AGENT = "StaxPayments-JavaScript/".concat(VERSION);
+// Some browsers do not allow setting the user-agent header, so we set
+// an alternative if running from a browser.
+var AGENT_HEADER = typeof window === 'undefined' ? 'User-Agent' : 'X-Requested-With';
+
+// DEFAULT_CORE_HOST is the default Stax core API host used when none is supplied.
+var DEFAULT_CORE_HOST = 'https://apiprod.fattlabs.com';
+
+// TRANSIENT_CREDENTIALS_PATH is the core API path that exchanges a Stax bearer
+// token for short-lived Stax Payments transient credentials. This is an
+// internal mechanism of the SDK and is never exposed as a public method.
+var TRANSIENT_CREDENTIALS_PATH = '/terminals/transient-credentials';
+
+// EXPIRY_SKEW_MS refreshes transient credentials this many milliseconds before
+// their stated expiry to avoid a credential lapsing mid-request (clock-skew
+// buffer).
+var EXPIRY_SKEW_MS = 30 * 1000;
+
+// EXPIRY_FALLBACK_MS is how long transient credentials are assumed to live when
+// the core API does not state an expiry. The core endpoint does not populate
+// expiresAt yet, so in practice this is the credential lifetime.
+var EXPIRY_FALLBACK_MS = 8 * 60 * 60 * 1000;
+
+// OFFLINE_FIXED_KEY is the static half of the offline route cache key. It is
+// hashed together with the current signing key, so a cache file is readable
+// only by a client holding the same credentials. It matches the constant used
+// by the other Stax Payments SDKs, so the cache format is portable between
+// them.
+var OFFLINE_FIXED_KEY = 'cb22789c9d5c344a10e0474f134db39e25eb3bbf5a1b1a5e89b507f15ea9519c';
+
+// StaxPaymentsBaseClient holds the shared transport: host configuration,
+// transient-credential exchange, and the gateway/dashboard/terminal/core
+// request plumbing. Each API namespace ships a client that wraps this base and
+// adds only the endpoint methods for that namespace (e.g. PaymentsClient); the
+// root StaxPaymentsClient builds one base and shares it across namespaces.
+var StaxPaymentsBaseClient = exports.StaxPaymentsBaseClient = /*#__PURE__*/function () {
+  // Construct the shared transport with your Stax bearer token. Terminal
+  // transactions transparently exchange it for short-lived transient
+  // credentials.
+  function StaxPaymentsBaseClient(creds) {
+    var opts = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
+    (0, _classCallCheck2["default"])(this, StaxPaymentsBaseClient);
+    this.gatewayHost = opts.gatewayHost || 'https://api.blockchyp.com';
+    this.testGatewayHost = 'https://test.blockchyp.com';
+    this.dashboardHost = 'https://dashboard.blockchyp.com';
+    this.coreHost = opts.coreHost || DEFAULT_CORE_HOST;
+    this.bearerToken = creds.bearerToken;
+    // bcCredentials holds the short-lived BlockChyp transient credentials
+    // obtained by exchanging the Stax bearer token. SDK-managed; never set by
+    // the integrator.
+    this.bcCredentials = undefined;
+    this.bcCredentialsExpiresAtMs = 0;
+    // Single-flight guard: concurrent callers share one in-flight exchange.
+    this.bcCredentialsInFlight = undefined;
+    this.https = true;
+    this.cloudRelay = false;
+    this.routeCacheTTL = 60;
+    this.gatewayTimeout = 20;
+    this.terminalTimeout = 120;
+    this._routeCache = {};
+  }
+  return (0, _createClass2["default"])(StaxPaymentsBaseClient, [{
+    key: "getGatewayHost",
+    value: function getGatewayHost() {
+      return this.gatewayHost;
+    }
+  }, {
+    key: "getDashboardHost",
+    value: function getDashboardHost() {
+      return this.dashboardHost;
+    }
+  }, {
+    key: "setGatewayHost",
+    value: function setGatewayHost(host) {
+      this.gatewayHost = host;
+    }
+  }, {
+    key: "setDashboardHost",
+    value: function setDashboardHost(host) {
+      this.dashboardHost = host;
+    }
+  }, {
+    key: "setTestGatewayHost",
+    value: function setTestGatewayHost(host) {
+      this.testGatewayHost = host;
+    }
+
+    // setCoreHost overrides the Stax core API host. An empty host resets it to the
+    // default. Cached credentials remain valid; subsequent exchanges and
+    // core-routed calls use the new host.
+  }, {
+    key: "setCoreHost",
+    value: function setCoreHost(host) {
+      this.coreHost = host || DEFAULT_CORE_HOST;
+    }
+  }, {
+    key: "heartbeat",
+    value: function heartbeat() {
+      return this._gatewayRequest('get', '/api/heartbeat');
+    }
+
+    // routeTransaction runs a transaction end to end, dispatching based on whether
+    // a terminal is named: to the terminal (card-present), directly or via cloud
+    // relay, when a terminal name is supplied, or to the gateway (card-not-present)
+    // otherwise.
+  }, {
+    key: "routeTransaction",
+    value: function () {
+      var _routeTransaction = (0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator["default"].mark(function _callee(method, request, terminalPath, cloudPath) {
+        var response, route, _t;
+        return _regenerator["default"].wrap(function (_context) {
+          while (1) switch (_context.prev = _context.next) {
+            case 0:
+              _context.next = 1;
+              return this.ensure();
+            case 1:
+              _context.next = 2;
+              return this._populateSignatureOptions(request);
+            case 2:
+              if (!this.isTerminalRouted(request)) {
+                _context.next = 8;
+                break;
+              }
+              _context.next = 3;
+              return this._resolveTerminalRoute(request.terminalName);
+            case 3:
+              route = _context.sent;
+              if (!route.cloudRelayEnabled) {
+                _context.next = 5;
+                break;
+              }
+              _context.next = 4;
+              return this._relayRequest(method, cloudPath, request);
+            case 4:
+              _t = _context.sent;
+              _context.next = 7;
+              break;
+            case 5:
+              _context.next = 6;
+              return this._terminalRequest(method, route, terminalPath, request);
+            case 6:
+              _t = _context.sent;
+            case 7:
+              response = _t;
+              _context.next = 10;
+              break;
+            case 8:
+              _context.next = 9;
+              return this._gatewayRequest(method, cloudPath, request);
+            case 9:
+              response = _context.sent;
+            case 10:
+              _context.next = 11;
+              return this._handleSignature(request, response ? response.data : undefined);
+            case 11:
+              return _context.abrupt("return", response);
+            case 12:
+            case "end":
+              return _context.stop();
+          }
+        }, _callee, this);
+      }));
+      function routeTransaction(_x, _x2, _x3, _x4) {
+        return _routeTransaction.apply(this, arguments);
+      }
+      return routeTransaction;
+    }()
+  }, {
+    key: "routeTransactionPost",
+    value: function () {
+      var _routeTransactionPost = (0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator["default"].mark(function _callee2(request, terminalPath, cloudPath) {
+        return _regenerator["default"].wrap(function (_context2) {
+          while (1) switch (_context2.prev = _context2.next) {
+            case 0:
+              return _context2.abrupt("return", this.routeTransaction('post', request, terminalPath, cloudPath));
+            case 1:
+            case "end":
+              return _context2.stop();
+          }
+        }, _callee2, this);
+      }));
+      function routeTransactionPost(_x5, _x6, _x7) {
+        return _routeTransactionPost.apply(this, arguments);
+      }
+      return routeTransactionPost;
+    }()
+  }, {
+    key: "returnValidationError",
+    value: function returnValidationError(desc) {
+      var result = {
+        data: {
+          approved: false,
+          success: false,
+          error: desc
+        }
+      };
+      return result;
+    }
+  }, {
+    key: "validateRequest",
+    value: function validateRequest(request) {
+      if (!this.validateCurrency(request.amount)) {
+        return false;
+      }
+      return true;
+    }
+  }, {
+    key: "validateCurrency",
+    value: function validateCurrency(val) {
+      var amt = parseFloat(val);
+      console.log(amt);
+      if (amt && !isNaN(amt)) {
+        var decMatch = val.match(/\./g || []);
+        if (decMatch && decMatch.length > 1) {
+          return false;
+        }
+        return true;
+      }
+      return false;
+    }
+
+    // isTerminalRouted reports whether a request names a terminal. Whether that
+    // terminal is reached directly or over cloud relay is a property of its
+    // route, resolved per terminal, not a client-wide setting.
+  }, {
+    key: "isTerminalRouted",
+    value: function isTerminalRouted(request) {
+      return Boolean(request && request.terminalName);
+    }
+
+    // ensure guarantees the client holds valid merchant-scoped transient
+    // credentials, exchanging the Stax bearer token via the core API when the
+    // cache is empty or near expiry. Concurrent callers share one in-flight
+    // exchange (single-flight). Terminal calls invoke this before routing.
+  }, {
+    key: "ensure",
+    value: function () {
+      var _ensure = (0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator["default"].mark(function _callee3() {
+        return _regenerator["default"].wrap(function (_context3) {
+          while (1) switch (_context3.prev = _context3.next) {
+            case 0:
+              if (!(this.bcCredentials && Date.now() + EXPIRY_SKEW_MS < this.bcCredentialsExpiresAtMs)) {
+                _context3.next = 1;
+                break;
+              }
+              return _context3.abrupt("return");
+            case 1:
+              if (!this.bcCredentialsInFlight) {
+                _context3.next = 3;
+                break;
+              }
+              _context3.next = 2;
+              return this.bcCredentialsInFlight;
+            case 2:
+              return _context3.abrupt("return");
+            case 3:
+              this.bcCredentialsInFlight = this._exchange();
+              _context3.prev = 4;
+              _context3.next = 5;
+              return this.bcCredentialsInFlight;
+            case 5:
+              _context3.prev = 5;
+              this.bcCredentialsInFlight = undefined;
+              return _context3.finish(5);
+            case 6:
+            case "end":
+              return _context3.stop();
+          }
+        }, _callee3, this, [[4,, 5, 6]]);
+      }));
+      function ensure() {
+        return _ensure.apply(this, arguments);
+      }
+      return ensure;
+    }()
+  }, {
+    key: "_exchange",
+    value: function () {
+      var _exchange2 = (0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator["default"].mark(function _callee4() {
+        var response, data;
+        return _regenerator["default"].wrap(function (_context4) {
+          while (1) switch (_context4.prev = _context4.next) {
+            case 0:
+              _context4.next = 1;
+              return this._coreRequest('get', TRANSIENT_CREDENTIALS_PATH);
+            case 1:
+              response = _context4.sent;
+              data = response.data;
+              this.bcCredentials = new StaxPaymentsCredentials(data.apiKey, data.bearerToken, data.signingKey);
+              this.bcCredentialsExpiresAtMs = data.expiresAt ? Date.parse(data.expiresAt) : Date.now() + EXPIRY_FALLBACK_MS;
+            case 2:
+            case "end":
+              return _context4.stop();
+          }
+        }, _callee4, this);
+      }));
+      function _exchange() {
+        return _exchange2.apply(this, arguments);
+      }
+      return _exchange;
+    }()
+  }, {
+    key: "_relayRequest",
+    value: function _relayRequest(method, path, request) {
+      return this._gatewayRequest(method, path, request, true);
+    }
+  }, {
+    key: "_uploadRequest",
+    value: function () {
+      var _uploadRequest2 = (0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator["default"].mark(function _callee5(path, request, content) {
+        var config;
+        return _regenerator["default"].wrap(function (_context5) {
+          while (1) switch (_context5.prev = _context5.next) {
+            case 0:
+              _context5.next = 1;
+              return this.ensure();
+            case 1:
+              config = {
+                method: 'post',
+                url: this._assembleDashboardUrl(path),
+                timeout: this._getTimeout(request, this.gatewayTimeout) * 1000,
+                headers: (0, _defineProperty2["default"])({}, AGENT_HEADER, USER_AGENT)
+              };
+              config.data = content;
+              if (this.bcCredentials && this.bcCredentials.apiKey) {
+                config.headers = Object.assign(config.headers, _cryptoutils["default"].generateGatewayHeaders(this.bcCredentials));
+              }
+              if (request.fileSize) {
+                config.headers['X-File-Size'] = request.fileSize.toFixed();
+              }
+              if (request.fileName) {
+                config.headers['X-Upload-File-Name'] = request.fileName;
+              }
+              if (request.uploadId) {
+                config.headers['X-Upload-ID'] = request.uploadId;
+              }
+              return _context5.abrupt("return", (0, _axios["default"])(config));
+            case 2:
+            case "end":
+              return _context5.stop();
+          }
+        }, _callee5, this);
+      }));
+      function _uploadRequest(_x8, _x9, _x0) {
+        return _uploadRequest2.apply(this, arguments);
+      }
+      return _uploadRequest;
+    }()
+  }, {
+    key: "_dashboardRequest",
+    value: function () {
+      var _dashboardRequest2 = (0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator["default"].mark(function _callee6(method, path, request) {
+        var config;
+        return _regenerator["default"].wrap(function (_context6) {
+          while (1) switch (_context6.prev = _context6.next) {
+            case 0:
+              _context6.next = 1;
+              return this.ensure();
+            case 1:
+              config = {
+                method: method,
+                url: this._assembleDashboardUrl(path),
+                timeout: this._getTimeout(request, this.gatewayTimeout) * 1000,
+                headers: (0, _defineProperty2["default"])((0, _defineProperty2["default"])({}, AGENT_HEADER, USER_AGENT), 'Content-Type', 'application/json')
+              };
+              if (method !== 'get') {
+                config.data = request;
+              }
+              if (this.bcCredentials && this.bcCredentials.apiKey) {
+                config.headers = Object.assign(config.headers, _cryptoutils["default"].generateGatewayHeaders(this.bcCredentials));
+              }
+              return _context6.abrupt("return", (0, _axios["default"])(config));
+            case 2:
+            case "end":
+              return _context6.stop();
+          }
+        }, _callee6, this);
+      }));
+      function _dashboardRequest(_x1, _x10, _x11) {
+        return _dashboardRequest2.apply(this, arguments);
+      }
+      return _dashboardRequest;
+    }()
+  }, {
+    key: "_gatewayRequest",
+    value: function () {
+      var _gatewayRequest2 = (0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator["default"].mark(function _callee7(method, path, request, relay) {
+        var config;
+        return _regenerator["default"].wrap(function (_context7) {
+          while (1) switch (_context7.prev = _context7.next) {
+            case 0:
+              _context7.next = 1;
+              return this.ensure();
+            case 1:
+              config = {
+                method: method,
+                url: this._assembleGatewayUrl(path, request),
+                timeout: this._getTimeout(request, relay ? this.terminalTimeout : this.gatewayTimeout) * 1000,
+                headers: (0, _defineProperty2["default"])((0, _defineProperty2["default"])({}, AGENT_HEADER, USER_AGENT), 'Content-Type', 'application/json')
+              };
+              if (method !== 'get') {
+                config.data = request;
+              }
+              if (this.bcCredentials && this.bcCredentials.apiKey) {
+                config.headers = Object.assign(config.headers, _cryptoutils["default"].generateGatewayHeaders(this.bcCredentials));
+              }
+              return _context7.abrupt("return", (0, _axios["default"])(config));
+            case 2:
+            case "end":
+              return _context7.stop();
+          }
+        }, _callee7, this);
+      }));
+      function _gatewayRequest(_x12, _x13, _x14, _x15) {
+        return _gatewayRequest2.apply(this, arguments);
+      }
+      return _gatewayRequest;
+    }() // _coreRequest sends a request to the Stax core API authenticated with the
+    // Stax bearer token. It mirrors _gatewayRequest/_dashboardRequest, differing
+    // only in host (coreHost) and auth (the Stax bearer token rather than HMAC
+    // credentials). Used by core-routed endpoints and the internal
+    // transient-credential exchange.
+  }, {
+    key: "_coreRequest",
+    value: function _coreRequest(method, path, request) {
+      var config = {
+        method: method,
+        url: this._assembleCoreUrl(path),
+        timeout: this._getTimeout(request, this.gatewayTimeout) * 1000,
+        headers: (0, _defineProperty2["default"])((0, _defineProperty2["default"])((0, _defineProperty2["default"])({}, AGENT_HEADER, USER_AGENT), 'Content-Type', 'application/json'), "Authorization", "Bearer ".concat(this.bearerToken))
+      };
+      if (method !== 'get') {
+        config.data = request;
+      }
+      return (0, _axios["default"])(config);
+    }
+  }, {
+    key: "_getTimeout",
+    value: function _getTimeout(request, defaultTimeout) {
+      if (request && 'timeout' in request) {
+        return request['timeout'];
+      }
+      return defaultTimeout;
+    }
+  }, {
+    key: "_assembleDashboardUrl",
+    value: function _assembleDashboardUrl(path) {
+      return this.dashboardHost + path;
+    }
+  }, {
+    key: "_assembleCoreUrl",
+    value: function _assembleCoreUrl(path) {
+      return this.coreHost + path;
+    }
+  }, {
+    key: "_assembleGatewayUrl",
+    value: function _assembleGatewayUrl(path, payload) {
+      var result = '';
+      if (payload && payload.test) {
+        result = result + this.testGatewayHost;
+      } else {
+        result = result + this.gatewayHost;
+      }
+      result = result + path;
+      return result;
+    }
+  }, {
+    key: "_terminalRequest",
+    value: function () {
+      var _terminalRequest2 = (0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator["default"].mark(function _callee8(method, route, path, request) {
+        var url, config;
+        return _regenerator["default"].wrap(function (_context8) {
+          while (1) switch (_context8.prev = _context8.next) {
+            case 0:
+              _context8.next = 1;
+              return this._assembleTerminalUrl(route, path);
+            case 1:
+              url = _context8.sent;
+              config = {
+                method: method,
+                url: url,
+                headers: (0, _defineProperty2["default"])((0, _defineProperty2["default"])({}, AGENT_HEADER, USER_AGENT), 'Content-Type', 'application/json'),
+                timeout: this._getTimeout(request, this.terminalTimeout) * 1000
+              };
+              if (this.https) {
+                if (_https["default"]) {
+                  config.httpsAgent = new _https["default"].Agent({
+                    rejectUnauthorized: false
+                  });
+                } else {
+                  config.httpsAgent = new _httpsBrowserify["default"].Agent({
+                    rejectUnauthorized: false
+                  });
+                  config.httpsAgent.protocol = 'https:';
+                }
+              }
+              if (request) {
+                config.data = {
+                  apiKey: route.transientCredentials.apiKey,
+                  bearerToken: route.transientCredentials.bearerToken,
+                  signingKey: route.transientCredentials.signingKey,
+                  request: request
+                };
+              }
+              return _context8.abrupt("return", (0, _axios["default"])(config));
+            case 2:
+            case "end":
+              return _context8.stop();
+          }
+        }, _callee8, this);
+      }));
+      function _terminalRequest(_x16, _x17, _x18, _x19) {
+        return _terminalRequest2.apply(this, arguments);
+      }
+      return _terminalRequest;
+    }()
+  }, {
+    key: "_assembleTerminalUrl",
+    value: function _assembleTerminalUrl(route, path) {
+      var result = 'http';
+      if (this.https) {
+        result = result + 's';
+      }
+      result = result + '://';
+      result = result + route.ipAddress;
+      if (this.https) {
+        result = result + ':8443';
+      } else {
+        result = result + ':8080';
+      }
+      result = result + path;
+      return result;
+    }
+
+    // _populateSignatureOptions infers the signature image format from the
+    // requested file extension when the caller did not state one, and rejects a
+    // format the terminal cannot produce before the transaction is sent.
+  }, {
+    key: "_populateSignatureOptions",
+    value: function () {
+      var _populateSignatureOptions2 = (0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator["default"].mark(function _callee9(request) {
+        var parts, valid;
+        return _regenerator["default"].wrap(function (_context9) {
+          while (1) switch (_context9.prev = _context9.next) {
+            case 0:
+              if (!(!request || !request.sigFile)) {
+                _context9.next = 1;
+                break;
+              }
+              return _context9.abrupt("return");
+            case 1:
+              if (!request.sigFormat) {
+                parts = String(request.sigFile).split('.');
+                request.sigFormat = parts[parts.length - 1].toLowerCase();
+              }
+              valid = [SignatureFormat.NONE, SignatureFormat.PNG, SignatureFormat.JPG, SignatureFormat.GIF];
+              if (!(valid.indexOf(request.sigFormat) < 0)) {
+                _context9.next = 2;
+                break;
+              }
+              throw new Error('invalid signature format: ' + request.sigFormat);
+            case 2:
+            case "end":
+              return _context9.stop();
+          }
+        }, _callee9);
+      }));
+      function _populateSignatureOptions(_x20) {
+        return _populateSignatureOptions2.apply(this, arguments);
+      }
+      return _populateSignatureOptions;
+    }() // _handleSignature writes the captured signature image to the file the caller
+    // asked for and clears it from the response, so the hex payload is not left
+    // in an object the caller is likely to log. Writing needs a filesystem, so in
+    // the browser the image is left on the response instead.
+  }, {
+    key: "_handleSignature",
+    value: function () {
+      var _handleSignature2 = (0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator["default"].mark(function _callee0(request, response) {
+        var fs, content;
+        return _regenerator["default"].wrap(function (_context0) {
+          while (1) switch (_context0.prev = _context0.next) {
+            case 0:
+              if (!(!request || !request.sigFile || !response || !response.sigFile)) {
+                _context0.next = 1;
+                break;
+              }
+              return _context0.abrupt("return");
+            case 1:
+              fs = optionalNodeModule('fs');
+              if (fs) {
+                _context0.next = 2;
+                break;
+              }
+              return _context0.abrupt("return");
+            case 2:
+              content = Buffer.from(response.sigFile, 'hex');
+              response.sigFile = '';
+              fs.writeFileSync(request.sigFile, content, {
+                mode: 384
+              });
+            case 3:
+            case "end":
+              return _context0.stop();
+          }
+        }, _callee0);
+      }));
+      function _handleSignature(_x21, _x22) {
+        return _handleSignature2.apply(this, arguments);
+      }
+      return _handleSignature;
+    }() // _offlineCacheFile is the path routes are persisted to, or undefined in the
+    // browser, where there is nothing to persist to.
+  }, {
+    key: "_offlineCacheFile",
+    value: function _offlineCacheFile() {
+      var os = optionalNodeModule('os');
+      var path = optionalNodeModule('path');
+      if (!os || !path) {
+        return undefined;
+      }
+      return path.join(os.tmpdir(), '.staxpayments_routes');
+    }
+
+    // _routeCacheKey scopes a cached route to the credentials that resolved it, so
+    // rotating credentials cannot serve a route resolved under the previous set.
+  }, {
+    key: "_routeCacheKey",
+    value: function _routeCacheKey(terminalName) {
+      return (this.bcCredentials ? this.bcCredentials.apiKey : '') + terminalName;
+    }
+
+    // _deriveOfflineKey hashes the fixed key together with the current signing
+    // key. The cache is therefore readable only while the same credentials are
+    // held, and unreadable to anything else that finds the file.
+  }, {
+    key: "_deriveOfflineKey",
+    value: function _deriveOfflineKey() {
+      var signingKey = this.bcCredentials ? this.bcCredentials.signingKey : '';
+      var input = new Uint8Array([].concat((0, _toConsumableArray2["default"])((0, _utils.hexToBytes)(OFFLINE_FIXED_KEY)), (0, _toConsumableArray2["default"])((0, _utils.hexToBytes)(signingKey))));
+      return (0, _sha.sha256)(input);
+    }
+
+    // AES/CBC/PKCS7 over the first 16 bytes of the derived key, hex encoded with
+    // the IV prefixed. The scheme is shared with the other Stax Payments SDKs.
+  }, {
+    key: "_encrypt",
+    value: function _encrypt(value) {
+      var key = this._deriveOfflineKey().slice(0, 16);
+      var iv = (0, _utils.randomBytes)(16);
+      var cbc = new _aesJs["default"].ModeOfOperation.cbc(key, iv);
+      var encrypted = cbc.encrypt(_aesJs["default"].padding.pkcs7.pad((0, _utils.utf8ToBytes)(value)));
+      return (0, _utils.bytesToHex)(iv) + (0, _utils.bytesToHex)(encrypted);
+    }
+  }, {
+    key: "_decrypt",
+    value: function _decrypt(value) {
+      var key = this._deriveOfflineKey().slice(0, 16);
+      var raw = (0, _utils.hexToBytes)(value);
+      var cbc = new _aesJs["default"].ModeOfOperation.cbc(key, raw.slice(0, 16));
+      var decrypted = _aesJs["default"].padding.pkcs7.strip(cbc.decrypt(raw.slice(16)));
+      return _aesJs["default"].utils.utf8.fromBytes(decrypted);
+    }
+  }, {
+    key: "_readOfflineCache",
+    value: function _readOfflineCache() {
+      var fs = optionalNodeModule('fs');
+      var file = this._offlineCacheFile();
+      if (!fs || !file) {
+        return undefined;
+      }
+      try {
+        if (!fs.existsSync(file)) {
+          return undefined;
+        }
+        return JSON.parse(fs.readFileSync(file, 'utf8'));
+      } catch (e) {
+        // An unreadable or corrupt cache is a missing cache, never a failed
+        // transaction.
+        return undefined;
+      }
+    }
+
+    // _readFromOfflineCache returns a persisted route. Credentials are decrypted
+    // on the way out. When stale is false an expired entry is ignored; when true
+    // it is served anyway, which is what keeps a terminal reachable while the
+    // gateway is not.
+  }, {
+    key: "_readFromOfflineCache",
+    value: function _readFromOfflineCache(terminalName, stale) {
+      var cache = this._readOfflineCache();
+      if (!cache || !cache.routes) {
+        return undefined;
+      }
+      var entry = cache.routes[this._routeCacheKey(terminalName)];
+      if (!entry) {
+        return undefined;
+      }
+      if (!stale && Date.parse(entry.TTL) <= Date.now()) {
+        return undefined;
+      }
+      try {
+        var route = entry.Route;
+        route.transientCredentials = {
+          apiKey: this._decrypt(route.transientCredentials.apiKey),
+          bearerToken: this._decrypt(route.transientCredentials.bearerToken),
+          signingKey: this._decrypt(route.transientCredentials.signingKey)
+        };
+        return route;
+      } catch (e) {
+        // Written under different credentials, so it cannot be decrypted now.
+        return undefined;
+      }
+    }
+  }, {
+    key: "_updateOfflineCache",
+    value: function _updateOfflineCache(route, ttlMs) {
+      var fs = optionalNodeModule('fs');
+      var file = this._offlineCacheFile();
+      if (!fs || !file) {
+        return;
+      }
+      try {
+        var cache = this._readOfflineCache() || {
+          routes: {}
+        };
+        if (!cache.routes) {
+          cache.routes = {};
+        }
+        cache.routes[this._routeCacheKey(route.terminalName)] = {
+          TTL: new Date(ttlMs).toISOString(),
+          Route: Object.assign({}, route, {
+            transientCredentials: {
+              apiKey: this._encrypt(route.transientCredentials.apiKey),
+              bearerToken: this._encrypt(route.transientCredentials.bearerToken),
+              signingKey: this._encrypt(route.transientCredentials.signingKey)
+            }
+          })
+        };
+        fs.writeFileSync(file, JSON.stringify(cache), {
+          mode: 384
+        });
+      } catch (e) {
+        // Persisting is an optimization; the in-memory cache still stands.
+      }
+    }
+
+    // _requestRouteFromGateway resolves a route and rejects anything that is not
+    // a usable one, so a failed lookup is never cached or routed on.
+  }, {
+    key: "_requestRouteFromGateway",
+    value: function () {
+      var _requestRouteFromGateway2 = (0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator["default"].mark(function _callee1(terminalName) {
+        var routeResponse, route;
+        return _regenerator["default"].wrap(function (_context1) {
+          while (1) switch (_context1.prev = _context1.next) {
+            case 0:
+              _context1.next = 1;
+              return this._gatewayRequest('get', '/api/terminal-route?terminal=' + encodeURIComponent(terminalName));
+            case 1:
+              routeResponse = _context1.sent;
+              route = routeResponse.data;
+              if (!(!route || route.success === false || !route.ipAddress)) {
+                _context1.next = 2;
+                break;
+              }
+              throw new Error('unknown terminal: ' + terminalName);
+            case 2:
+              route.exists = true;
+              route.https = true;
+              return _context1.abrupt("return", route);
+            case 3:
+            case "end":
+              return _context1.stop();
+          }
+        }, _callee1, this);
+      }));
+      function _requestRouteFromGateway(_x23) {
+        return _requestRouteFromGateway2.apply(this, arguments);
+      }
+      return _requestRouteFromGateway;
+    }()
+  }, {
+    key: "_resolveTerminalRoute",
+    value: function () {
+      var _resolveTerminalRoute2 = (0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator["default"].mark(function _callee10(terminalName) {
+        var key, cacheEntry, offline, route, stale, ttl, _t2;
+        return _regenerator["default"].wrap(function (_context10) {
+          while (1) switch (_context10.prev = _context10.next) {
+            case 0:
+              key = this._routeCacheKey(terminalName);
+              cacheEntry = this._routeCache[key];
+              if (!(cacheEntry && cacheEntry.ttl >= new Date().getTime())) {
+                _context10.next = 1;
+                break;
+              }
+              return _context10.abrupt("return", cacheEntry.route);
+            case 1:
+              if (!((terminalName.match(/\./g) || []).length === 3)) {
+                _context10.next = 2;
+                break;
+              }
+              return _context10.abrupt("return", {
+                terminalName: terminalName,
+                ipAddress: terminalName,
+                cloudRelayEnabled: false,
+                exists: true,
+                https: false,
+                transientCredentials: {
+                  apiKey: '',
+                  bearerToken: '',
+                  signingKey: ''
+                }
+              });
+            case 2:
+              offline = this._readFromOfflineCache(terminalName, false);
+              if (!offline) {
+                _context10.next = 3;
+                break;
+              }
+              return _context10.abrupt("return", offline);
+            case 3:
+              _context10.prev = 3;
+              _context10.next = 4;
+              return this._requestRouteFromGateway(terminalName);
+            case 4:
+              route = _context10.sent;
+              _context10.next = 7;
+              break;
+            case 5:
+              _context10.prev = 5;
+              _t2 = _context10["catch"](3);
+              // The gateway is unreachable or does not know the terminal. A stale
+              // persisted route is better than no transaction.
+              stale = this._readFromOfflineCache(terminalName, true);
+              if (!stale) {
+                _context10.next = 6;
+                break;
+              }
+              return _context10.abrupt("return", stale);
+            case 6:
+              throw _t2;
+            case 7:
+              ttl = new Date().getTime() + this.routeCacheTTL * 60000;
+              this._routeCache[key] = {
+                ttl: ttl,
+                route: route
+              };
+              this._updateOfflineCache(route, ttl);
+              return _context10.abrupt("return", route);
+            case 8:
+            case "end":
+              return _context10.stop();
+          }
+        }, _callee10, this, [[3, 5]]);
+      }));
+      function _resolveTerminalRoute(_x24) {
+        return _resolveTerminalRoute2.apply(this, arguments);
+      }
+      return _resolveTerminalRoute;
+    }()
+  }]);
+}(); // StaxApiCredentials is the Stax bearer token used to construct a client. It is
+// the only credential an integrator supplies; the BlockChyp gateway credentials
+// are obtained and managed internally by the SDK.
+var StaxApiCredentials = exports.StaxApiCredentials = /*#__PURE__*/(0, _createClass2["default"])(function StaxApiCredentials(bearerToken) {
+  (0, _classCallCheck2["default"])(this, StaxApiCredentials);
+  this.bearerToken = bearerToken;
+}); // StaxPaymentsCredentials models the BlockChyp gateway credentials the SDK
+// obtains by exchanging the bearer token. It is internal to the SDK.
+var StaxPaymentsCredentials = exports.StaxPaymentsCredentials = /*#__PURE__*/(0, _createClass2["default"])(function StaxPaymentsCredentials(apiKey, bearerToken, signingKey) {
+  (0, _classCallCheck2["default"])(this, StaxPaymentsCredentials);
+  this.apiKey = apiKey;
+  this.bearerToken = bearerToken;
+  this.signingKey = signingKey;
+});