@thavguard/arc-pay 0.1.0 → 0.1.1

package/dist/server/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/errors.ts","../../src/server/client.ts"],"names":[],"mappings":";AAqBO,IAAM,WAAA,GAAN,cAA0B,KAAA,CAAM;AAAA,EASrC,YAAY,IAAA,EAAuB;AACjC,IAAA,KAAA,CAAM,KAAK,OAAO,CAAA;AAClB,IAAA,IAAA,CAAK,IAAA,GAAO,aAAA;AACZ,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,QAAQ,IAAA,CAAK,KAAA;AAClB,IAAA,IAAA,CAAK,YAAY,IAAA,CAAK,SAAA;AACtB,IAAA,IAAA,CAAK,cAAc,IAAA,CAAK,WAAA;AACxB,IAAA,IAAA,CAAK,YAAY,IAAA,CAAK,SAAA;AACtB,IAAA,IAAA,CAAK,YAAY,IAAA,CAAK,SAAA;AAAA,EACxB;AACF,CAAA;;;ACoBA,IAAM,gBAAA,GAAmB,6BAAA;AACzB,IAAM,WAAA,GAAc,YAAA;AAEpB,SAAS,kBAAkB,GAAA,EAAqC;AAC9D,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,WAAW,CAAA,EAAG;AAC/C,IAAA,MAAM,IAAI,WAAA,CAAY;AAAA,MACpB,IAAA,EAAM,sBAAA;AAAA,MACN,IAAA,EAAM,oBAAA;AAAA,MACN,OAAA,EAAS,uCAAA;AAAA,MACT,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,EACH;AACA,EAAA,IAAI,CAAC,IAAI,UAAA,CAAW,UAAU,KAAK,CAAC,GAAA,CAAI,UAAA,CAAW,UAAU,CAAA,EAAG;AAC9D,IAAA,MAAM,IAAI,WAAA,CAAY;AAAA,MACpB,IAAA,EAAM,sBAAA;AAAA,MACN,IAAA,EAAM,oBAAA;AAAA,MACN,OAAA,EAAS,4FAAA;AAAA,MACT,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,EACH;AACF;AAEA,IAAM,gBAAgB,CAAC,IAAA,KAAyB,IAAA,CAAK,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAEvE,IAAM,qBAAA,GAAwB,CAAC,IAAA,KAAqC;AAClE,EAAA,IAAI,CAAC,KAAK,cAAA,EAAgB;AACxB,IAAA,MAAM,IAAI,WAAA,CAAY;AAAA,MACpB,IAAA,EAAM,kBAAA;AAAA,MACN,IAAA,EAAM,yBAAA;AAAA,MACN,OAAA,EAAS,+CAAA;AAAA,MACT,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,EACH;AACA,EAAA,OAAO,IAAA,CAAK,cAAA;AACd,CAAA;AAEA,IAAM,WAAA,GAAc,CAAC,IAAA,EAAc,KAAA,KAA2B;AAC5D,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,EAAgB;AACnC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAChD,IAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,IAAQ,UAAU,EAAA,EAAI;AAC3D,IAAA,MAAA,CAAO,GAAA,CAAI,GAAA,EAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,EAC/B;AACA,EAAA,MAAM,OAAA,GAAU,OAAO,QAAA,EAAS;AAChC,EAAA,OAAO,OAAA,GAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,GAAK,IAAA;AAC1C,CAAA;AAaA,IAAM,iBAAA,GAAoB,CAAC,KAAA,KACzB,KAAA,KAAU,kBAAA,IACV,KAAA,KAAU,sBAAA,IACV,KAAA,KAAU,qBAAA,IACV,KAAA,KAAU,aAAA,IACV,KAAA,KAAU,sBACV,KAAA,KAAU,WAAA;AAEZ,IAAM,kBAAA,GAAqB,OAAO,GAAA,KAAwC;AA/H1E,EAAA,IAAA,EAAA,EAAA,EAAA;AAgIE,EAAA,IAAI,OAAqB,EAAC;AAC1B,EAAA,IAAI;AACF,IAAA,IAAA,GAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,EACzB,CAAA,CAAA,OAAQ,CAAA,EAAA;AAAA,EAER;AACA,EAAA,MAAM,MAAA,GAAA,CAAS,EAAA,GAAA,IAAA,CAAK,KAAA,KAAL,IAAA,GAAA,EAAA,GAAc,EAAC;AAC9B,EAAA,MAAM,IAAA,GAAO,iBAAA,CAAkB,MAAA,CAAO,IAAI,CAAA,GACtC,OAAO,IAAA,GACP,GAAA,CAAI,MAAA,IAAU,GAAA,GACZ,WAAA,GACA,kBAAA;AACN,EAAA,OAAO,IAAI,WAAA,CAAY;AAAA,IACrB,IAAA;AAAA,IACA,MAAM,MAAA,CAAO,IAAA;AAAA,IACb,UAAS,EAAA,GAAA,MAAA,CAAO,OAAA,KAAP,IAAA,GAAA,EAAA,GAAkB,CAAA,2BAAA,EAA8B,IAAI,MAAM,CAAA,CAAA;AAAA,IACnE,OAAO,MAAA,CAAO,KAAA;AAAA,IACd,WAAW,MAAA,CAAO,UAAA;AAAA,IAClB,aAAa,MAAA,CAAO,YAAA;AAAA,IACpB,SAAA,EAAW,IAAA,KAAS,WAAA,IAAe,IAAA,KAAS;AAAA,GAC7C,CAAA;AACH,CAAA;AAEO,IAAM,eAAN,MAAmB;AAAA,EAKxB,YAAY,OAAA,EAA8B;AA5J5C,IAAA,IAAA,EAAA,EAAA,EAAA;AA6JI,IAAA,MAAM,YAAqB,OAAA,CAAQ,SAAA;AACnC,IAAA,iBAAA,CAAkB,SAAS,CAAA;AAC3B,IAAA,IAAI,CAAC,OAAA,CAAQ,KAAA,IAAS,OAAO,UAAU,WAAA,EAAa;AAClD,MAAA,MAAM,IAAI,WAAA,CAAY;AAAA,QACpB,IAAA,EAAM,WAAA;AAAA,QACN,IAAA,EAAM,mBAAA;AAAA,QACN,OAAA,EAAS,oDAAA;AAAA,QACT,SAAA,EAAW;AAAA,OACZ,CAAA;AAAA,IACH;AACA,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,IAAA,CAAK,OAAA,GAAU,aAAA,CAAA,CAAc,EAAA,GAAA,OAAA,CAAQ,OAAA,KAAR,YAAmB,gBAAgB,CAAA;AAChE,IAAA,IAAA,CAAK,SAAA,GAAA,CAAY,EAAA,GAAA,OAAA,CAAQ,KAAA,KAAR,IAAA,GAAA,EAAA,GAAiB,KAAA;AAAA,EACpC;AAAA,EAEA,MAAM,YAAA,CAAa,KAAA,GAA2B,EAAC,EAAG,IAAA,GAAuB,EAAC,EAAyB;AACjG,IAAA,OAAO,IAAA,CAAK,QAAqB,KAAA,EAAO,WAAA,CAAY,aAAa,KAAK,CAAA,EAAG,QAAW,IAAI,CAAA;AAAA,EAC1F;AAAA,EAEA,MAAM,aAAA,CAAc,IAAA,EAA4B,IAAA,EAA4C;AAC1F,IAAA,OAAO,IAAA,CAAK,OAAA,CAAiB,MAAA,EAAQ,WAAA,EAAa,MAAM,IAAI,CAAA;AAAA,EAC9D;AAAA,EAEA,MAAM,UAAA,CAAW,SAAA,EAAmB,IAAA,GAAuB,EAAC,EAAqB;AAC/E,IAAA,OAAO,IAAA,CAAK,QAAiB,KAAA,EAAO,CAAA,UAAA,EAAa,mBAAmB,SAAS,CAAC,CAAA,CAAA,EAAI,MAAA,EAAW,IAAI,CAAA;AAAA,EACnG;AAAA,EAEA,MAAM,cAAA,CACJ,SAAA,EACA,IAAA,EACA,IAAA,EACkB;AAClB,IAAA,OAAO,IAAA,CAAK,QAAiB,MAAA,EAAQ,CAAA,UAAA,EAAa,mBAAmB,SAAS,CAAC,CAAA,QAAA,CAAA,EAAY,IAAA,EAAM,IAAI,CAAA;AAAA,EACvG;AAAA,EAEA,MAAM,WAAA,CACJ,SAAA,EACA,IAAA,EACA,IAAA,EACkB;AAClB,IAAA,OAAO,IAAA,CAAK,QAAiB,MAAA,EAAQ,CAAA,UAAA,EAAa,mBAAmB,SAAS,CAAC,CAAA,KAAA,CAAA,EAAS,IAAA,EAAM,IAAI,CAAA;AAAA,EACpG;AAAA,EAEA,MAAM,YAAA,CACJ,SAAA,EACA,IAAA,EACA,IAAA,EACiB;AACjB,IAAA,OAAO,IAAA,CAAK,QAAgB,MAAA,EAAQ,CAAA,UAAA,EAAa,mBAAmB,SAAS,CAAC,CAAA,QAAA,CAAA,EAAY,IAAA,EAAM,IAAI,CAAA;AAAA,EACtG;AAAA,EAEA,MAAM,cAAA,CACJ,SAAA,EACA,IAAA,EACA,IAAA,EACiC;AACjC,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,MAAA;AAAA,MACA,CAAA,UAAA,EAAa,kBAAA,CAAmB,SAAS,CAAC,CAAA,QAAA,CAAA;AAAA,MAC1C,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EAEA,MAAM,qBAAA,CACJ,SAAA,EACA,IAAA,EACA,IAAA,GAAuB,EAAC,EACS;AACjC,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,MAAA;AAAA,MACA,CAAA,UAAA,EAAa,kBAAA,CAAmB,SAAS,CAAC,CAAA,oBAAA,CAAA;AAAA,MAC1C,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EAEA,MAAM,2BAAA,CACJ,KAAA,EACA,IAAA,GAAuB,EAAC,EACW;AACnC,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,KAAA;AAAA,MACA,WAAA,CAAY,8BAA8B,KAAK,CAAA;AAAA,MAC/C,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EAEA,MAAM,UAAA,CAAW,IAAA,EAAyB,IAAA,EAAyC;AACjF,IAAA,OAAO,IAAA,CAAK,OAAA,CAAc,MAAA,EAAQ,QAAA,EAAU,MAAM,IAAI,CAAA;AAAA,EACxD;AAAA,EAEA,MAAM,qBAAA,CACJ,IAAA,EACA,IAAA,EAC0B;AAC1B,IAAA,OAAO,IAAA,CAAK,OAAA,CAAyB,MAAA,EAAQ,oBAAA,EAAsB,MAAM,IAAI,CAAA;AAAA,EAC/E;AAAA,EAEA,MAAc,OAAA,CACZ,MAAA,EACA,IAAA,EACA,MACA,IAAA,EACY;AACZ,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,SAAS,CAAA,CAAA;AAAA,MACvC,uBAAA,EAAyB,WAAA;AAAA,MACzB,cAAA,EAAgB;AAAA,KAClB;AACA,IAAA,IAAI,oBAAoB,IAAA,EAAM;AAC5B,MAAA,OAAA,CAAQ,iBAAiB,CAAA,GAAI,qBAAA,CAAsB,IAAI,CAAA;AAAA,IACzD;AAEA,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,KAAK,SAAA,CAAU,CAAA,EAAG,KAAK,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,QACnD,MAAA;AAAA,QACA,OAAA;AAAA,QACA,MAAM,IAAA,KAAS,KAAA,CAAA,GAAY,KAAA,CAAA,GAAY,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,QAC1D,QAAQ,IAAA,CAAK;AAAA,OACd,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,WAAA,CAAY;AAAA,QACpB,IAAA,EAAM,eAAA;AAAA,QACN,OAAA,EAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,wBAAA;AAAA,QAC9C,SAAA,EAAW;AAAA,OACZ,CAAA;AAAA,IACH;AACA,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,MAAM,MAAM,mBAAmB,GAAG,CAAA;AAC/C,IAAA,OAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,EACzB;AACF;AAEO,IAAM,kBAAA,GAAqB,CAAC,OAAA,KACjC,IAAI,aAAa,OAAO","file":"index.mjs","sourcesContent":["export type ArcPayErrorType =\n  | \"validation_error\"\n  | \"authentication_error\"\n  | \"authorization_error\"\n  | \"state_error\"\n  | \"rate_limit_error\"\n  | \"api_error\"\n  | \"network_error\"\n  | \"challenge_aborted\";\n\nexport interface ArcPayErrorInit {\n  type: ArcPayErrorType;\n  message: string;\n  code?: string;\n  param?: string;\n  paymentId?: string;\n  declineCode?: string;\n  retryable: boolean;\n  requestId?: string;\n}\n\nexport class ArcPayError extends Error {\n  readonly type: ArcPayErrorType;\n  readonly code?: string;\n  readonly param?: string;\n  readonly paymentId?: string;\n  readonly declineCode?: string;\n  readonly retryable: boolean;\n  readonly requestId?: string;\n\n  constructor(init: ArcPayErrorInit) {\n    super(init.message);\n    this.name = \"ArcPayError\";\n    this.type = init.type;\n    this.code = init.code;\n    this.param = init.param;\n    this.paymentId = init.paymentId;\n    this.declineCode = init.declineCode;\n    this.retryable = init.retryable;\n    this.requestId = init.requestId;\n  }\n}\n\nexport const isValidationError = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"validation_error\";\nexport const isAuthenticationError = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"authentication_error\";\nexport const isAuthorizationError = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"authorization_error\";\nexport const isStateError = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"state_error\";\nexport const isRateLimitError = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"rate_limit_error\";\nexport const isApiError = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"api_error\";\nexport const isNetworkError = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"network_error\";\nexport const isChallengeAborted = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"challenge_aborted\";\n","import { ArcPayError, type ArcPayErrorType } from \"../core/errors\";\nimport type {\n  AvailablePaymentMethod,\n  CaptureRequest,\n  CheckoutSession,\n  CompleteThreeDSMethodRequest,\n  CreateCheckoutSessionRequest,\n  CreateLinkRequest,\n  CreatePaymentRequest,\n  CreateRefundRequest,\n  ExecutePaymentRequest,\n  ExecutePaymentResponse,\n  Link,\n  ListAvailablePaymentMethodsQuery,\n  ListPaymentsQuery,\n  Payment,\n  PaymentList,\n  Refund,\n  VoidRequest,\n} from \"./types\";\n\nexport type {\n  AvailablePaymentMethod,\n  CaptureMode,\n  CaptureRequest,\n  CheckoutSession,\n  CompleteThreeDSMethodRequest,\n  CreateCheckoutSessionRequest,\n  CreateLinkRequest,\n  CreatePaymentRequest,\n  CreateRefundRequest,\n  Currency,\n  ExecutePaymentRequest,\n  ExecutePaymentResponse,\n  Link,\n  ListAvailablePaymentMethodsQuery,\n  ListPaymentsQuery,\n  Payment,\n  PaymentFlowMode,\n  PaymentList,\n  PaymentMethod,\n  PaymentStatus,\n  Refund,\n  VoidRequest,\n} from \"./types\";\n\nexport interface ArcPayClientOptions {\n  secretKey: string;\n  apiBase?: string;\n  fetch?: typeof fetch;\n}\n\nexport interface IdempotencyOptions {\n  idempotencyKey: string;\n  signal?: AbortSignal;\n}\n\nexport interface RequestOptions {\n  signal?: AbortSignal;\n}\n\nconst DEFAULT_API_BASE = \"https://api.arcpay.space/v1\";\nconst API_VERSION = \"2026-05-06\";\n\nfunction validateSecretKey(key: unknown): asserts key is string {\n  if (typeof key !== \"string\" || key.length === 0) {\n    throw new ArcPayError({\n      type: \"authentication_error\",\n      code: \"invalid_secret_key\",\n      message: \"Secret key must be a non-empty string\",\n      retryable: false,\n    });\n  }\n  if (!key.startsWith(\"sk_test_\") && !key.startsWith(\"sk_live_\")) {\n    throw new ArcPayError({\n      type: \"authentication_error\",\n      code: \"invalid_secret_key\",\n      message: \"Secret key must start with sk_test_ or sk_live_. Publishable keys cannot call server APIs.\",\n      retryable: false,\n    });\n  }\n}\n\nconst normalizeBase = (base: string): string => base.replace(/\\/+$/, \"\");\n\nconst requireIdempotencyKey = (opts: IdempotencyOptions): string => {\n  if (!opts.idempotencyKey) {\n    throw new ArcPayError({\n      type: \"validation_error\",\n      code: \"missing_idempotency_key\",\n      message: \"idempotencyKey is required for this operation\",\n      retryable: false,\n    });\n  }\n  return opts.idempotencyKey;\n};\n\nconst appendQuery = (path: string, query?: object): string => {\n  if (!query) return path;\n  const params = new URLSearchParams();\n  for (const [key, value] of Object.entries(query)) {\n    if (value === undefined || value === null || value === \"\") continue;\n    params.set(key, String(value));\n  }\n  const encoded = params.toString();\n  return encoded ? `${path}?${encoded}` : path;\n};\n\ninterface APIErrorBody {\n  error?: {\n    type?: string;\n    code?: string;\n    message?: string;\n    param?: string;\n    request_id?: string;\n    decline_code?: string;\n  };\n}\n\nconst isPublicErrorType = (value: unknown): value is ArcPayErrorType =>\n  value === \"validation_error\" ||\n  value === \"authentication_error\" ||\n  value === \"authorization_error\" ||\n  value === \"state_error\" ||\n  value === \"rate_limit_error\" ||\n  value === \"api_error\";\n\nconst parseErrorResponse = async (res: Response): Promise<ArcPayError> => {\n  let body: APIErrorBody = {};\n  try {\n    body = (await res.json()) as APIErrorBody;\n  } catch {\n    /* keep default error below */\n  }\n  const detail = body.error ?? {};\n  const type = isPublicErrorType(detail.type)\n    ? detail.type\n    : res.status >= 500\n      ? \"api_error\"\n      : \"validation_error\";\n  return new ArcPayError({\n    type,\n    code: detail.code,\n    message: detail.message ?? `Request failed with status ${res.status}`,\n    param: detail.param,\n    requestId: detail.request_id,\n    declineCode: detail.decline_code,\n    retryable: type === \"api_error\" || type === \"rate_limit_error\",\n  });\n};\n\nexport class ArcPayClient {\n  private readonly secretKey: string;\n  private readonly apiBase: string;\n  private readonly fetchImpl: typeof fetch;\n\n  constructor(options: ArcPayClientOptions) {\n    const secretKey: unknown = options.secretKey;\n    validateSecretKey(secretKey);\n    if (!options.fetch && typeof fetch === \"undefined\") {\n      throw new ArcPayError({\n        type: \"api_error\",\n        code: \"fetch_unavailable\",\n        message: \"A fetch implementation is required in this runtime\",\n        retryable: false,\n      });\n    }\n    this.secretKey = secretKey;\n    this.apiBase = normalizeBase(options.apiBase ?? DEFAULT_API_BASE);\n    this.fetchImpl = options.fetch ?? fetch;\n  }\n\n  async listPayments(query: ListPaymentsQuery = {}, opts: RequestOptions = {}): Promise<PaymentList> {\n    return this.request<PaymentList>(\"GET\", appendQuery(\"/payments\", query), undefined, opts);\n  }\n\n  async createPayment(body: CreatePaymentRequest, opts: IdempotencyOptions): Promise<Payment> {\n    return this.request<Payment>(\"POST\", \"/payments\", body, opts);\n  }\n\n  async getPayment(paymentId: string, opts: RequestOptions = {}): Promise<Payment> {\n    return this.request<Payment>(\"GET\", `/payments/${encodeURIComponent(paymentId)}`, undefined, opts);\n  }\n\n  async capturePayment(\n    paymentId: string,\n    body: CaptureRequest,\n    opts: IdempotencyOptions,\n  ): Promise<Payment> {\n    return this.request<Payment>(\"POST\", `/payments/${encodeURIComponent(paymentId)}/capture`, body, opts);\n  }\n\n  async voidPayment(\n    paymentId: string,\n    body: VoidRequest,\n    opts: IdempotencyOptions,\n  ): Promise<Payment> {\n    return this.request<Payment>(\"POST\", `/payments/${encodeURIComponent(paymentId)}/void`, body, opts);\n  }\n\n  async createRefund(\n    paymentId: string,\n    body: CreateRefundRequest,\n    opts: IdempotencyOptions,\n  ): Promise<Refund> {\n    return this.request<Refund>(\"POST\", `/payments/${encodeURIComponent(paymentId)}/refunds`, body, opts);\n  }\n\n  async executePayment(\n    paymentId: string,\n    body: ExecutePaymentRequest,\n    opts: IdempotencyOptions,\n  ): Promise<ExecutePaymentResponse> {\n    return this.request<ExecutePaymentResponse>(\n      \"POST\",\n      `/payments/${encodeURIComponent(paymentId)}/execute`,\n      body,\n      opts,\n    );\n  }\n\n  async completeThreeDSMethod(\n    paymentId: string,\n    body: CompleteThreeDSMethodRequest,\n    opts: RequestOptions = {},\n  ): Promise<ExecutePaymentResponse> {\n    return this.request<ExecutePaymentResponse>(\n      \"POST\",\n      `/payments/${encodeURIComponent(paymentId)}/complete-3ds-method`,\n      body,\n      opts,\n    );\n  }\n\n  async listAvailablePaymentMethods(\n    query: ListAvailablePaymentMethodsQuery,\n    opts: RequestOptions = {},\n  ): Promise<AvailablePaymentMethod[]> {\n    return this.request<AvailablePaymentMethod[]>(\n      \"GET\",\n      appendQuery(\"/payment-methods/available\", query),\n      undefined,\n      opts,\n    );\n  }\n\n  async createLink(body: CreateLinkRequest, opts: IdempotencyOptions): Promise<Link> {\n    return this.request<Link>(\"POST\", \"/links\", body, opts);\n  }\n\n  async createCheckoutSession(\n    body: CreateCheckoutSessionRequest,\n    opts: IdempotencyOptions,\n  ): Promise<CheckoutSession> {\n    return this.request<CheckoutSession>(\"POST\", \"/checkout/sessions\", body, opts);\n  }\n\n  private async request<T>(\n    method: \"GET\" | \"POST\",\n    path: string,\n    body: unknown,\n    opts: RequestOptions | IdempotencyOptions,\n  ): Promise<T> {\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${this.secretKey}`,\n      \"X-Arc-Pay-API-Version\": API_VERSION,\n      \"Content-Type\": \"application/json\",\n    };\n    if (\"idempotencyKey\" in opts) {\n      headers[\"Idempotency-Key\"] = requireIdempotencyKey(opts);\n    }\n\n    let res: Response;\n    try {\n      res = await this.fetchImpl(`${this.apiBase}${path}`, {\n        method,\n        headers,\n        body: body === undefined ? undefined : JSON.stringify(body),\n        signal: opts.signal,\n      });\n    } catch (err) {\n      throw new ArcPayError({\n        type: \"network_error\",\n        message: err instanceof Error ? err.message : \"Network request failed\",\n        retryable: true,\n      });\n    }\n    if (!res.ok) throw await parseErrorResponse(res);\n    return (await res.json()) as T;\n  }\n}\n\nexport const createArcPayClient = (options: ArcPayClientOptions): ArcPayClient =>\n  new ArcPayClient(options);\n"]}
+{"version":3,"sources":["../../src/core/errors.ts","../../src/server/client.ts"],"names":[],"mappings":";AAqBO,IAAM,WAAA,GAAN,cAA0B,KAAA,CAAM;AAAA,EASrC,YAAY,IAAA,EAAuB;AACjC,IAAA,KAAA,CAAM,KAAK,OAAO,CAAA;AAClB,IAAA,IAAA,CAAK,IAAA,GAAO,aAAA;AACZ,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,QAAQ,IAAA,CAAK,KAAA;AAClB,IAAA,IAAA,CAAK,YAAY,IAAA,CAAK,SAAA;AACtB,IAAA,IAAA,CAAK,cAAc,IAAA,CAAK,WAAA;AACxB,IAAA,IAAA,CAAK,YAAY,IAAA,CAAK,SAAA;AACtB,IAAA,IAAA,CAAK,YAAY,IAAA,CAAK,SAAA;AAAA,EACxB;AACF,CAAA;;;ACsBA,IAAM,gBAAA,GAAmB,6BAAA;AACzB,IAAM,WAAA,GAAc,YAAA;AAEpB,SAAS,kBAAkB,GAAA,EAAqC;AAC9D,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,WAAW,CAAA,EAAG;AAC/C,IAAA,MAAM,IAAI,WAAA,CAAY;AAAA,MACpB,IAAA,EAAM,sBAAA;AAAA,MACN,IAAA,EAAM,oBAAA;AAAA,MACN,OAAA,EAAS,uCAAA;AAAA,MACT,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,EACH;AACA,EAAA,IAAI,CAAC,IAAI,UAAA,CAAW,UAAU,KAAK,CAAC,GAAA,CAAI,UAAA,CAAW,UAAU,CAAA,EAAG;AAC9D,IAAA,MAAM,IAAI,WAAA,CAAY;AAAA,MACpB,IAAA,EAAM,sBAAA;AAAA,MACN,IAAA,EAAM,oBAAA;AAAA,MACN,OAAA,EACE,4FAAA;AAAA,MACF,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,EACH;AACF;AAEA,IAAM,gBAAgB,CAAC,IAAA,KAAyB,IAAA,CAAK,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAMvE,IAAM,uBAAA,GAA0B,CAC9B,IAAA,KAC0C,IAAA,IAAA,IAAA,GAAA,IAAA,GAAQ,EAAC;AAErD,IAAM,qBAAA,GAAwB,CAAC,IAAA,KAAwD;AACrF,EAAA,IAAI,CAAC,KAAK,cAAA,EAAgB;AACxB,IAAA,MAAM,IAAI,WAAA,CAAY;AAAA,MACpB,IAAA,EAAM,kBAAA;AAAA,MACN,IAAA,EAAM,yBAAA;AAAA,MACN,OAAA,EAAS,+CAAA;AAAA,MACT,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,EACH;AACA,EAAA,OAAO,IAAA,CAAK,cAAA;AACd,CAAA;AAEA,IAAM,WAAA,GAAc,CAAC,IAAA,EAAc,KAAA,KAA2B;AAC5D,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,EAAgB;AACnC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAChD,IAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,IAAQ,UAAU,EAAA,EAAI;AAC3D,IAAA,MAAA,CAAO,GAAA,CAAI,GAAA,EAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,EAC/B;AACA,EAAA,MAAM,OAAA,GAAU,OAAO,QAAA,EAAS;AAChC,EAAA,OAAO,OAAA,GAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,GAAK,IAAA;AAC1C,CAAA;AAaA,IAAM,iBAAA,GAAoB,CAAC,KAAA,KACzB,KAAA,KAAU,kBAAA,IACV,KAAA,KAAU,sBAAA,IACV,KAAA,KAAU,qBAAA,IACV,KAAA,KAAU,aAAA,IACV,KAAA,KAAU,sBACV,KAAA,KAAU,WAAA;AAEZ,IAAM,kBAAA,GAAqB,OAAO,GAAA,KAAwC;AA1I1E,EAAA,IAAA,EAAA,EAAA,EAAA;AA2IE,EAAA,IAAI,OAAqB,EAAC;AAC1B,EAAA,IAAI;AACF,IAAA,IAAA,GAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,EACzB,CAAA,CAAA,OAAQ,CAAA,EAAA;AAAA,EAER;AACA,EAAA,MAAM,MAAA,GAAA,CAAS,EAAA,GAAA,IAAA,CAAK,KAAA,KAAL,IAAA,GAAA,EAAA,GAAc,EAAC;AAC9B,EAAA,MAAM,IAAA,GAAO,iBAAA,CAAkB,MAAA,CAAO,IAAI,CAAA,GACtC,OAAO,IAAA,GACP,GAAA,CAAI,MAAA,IAAU,GAAA,GACZ,WAAA,GACA,kBAAA;AACN,EAAA,OAAO,IAAI,WAAA,CAAY;AAAA,IACrB,IAAA;AAAA,IACA,MAAM,MAAA,CAAO,IAAA;AAAA,IACb,UAAS,EAAA,GAAA,MAAA,CAAO,OAAA,KAAP,IAAA,GAAA,EAAA,GAAkB,CAAA,2BAAA,EAA8B,IAAI,MAAM,CAAA,CAAA;AAAA,IACnE,OAAO,MAAA,CAAO,KAAA;AAAA,IACd,WAAW,MAAA,CAAO,UAAA;AAAA,IAClB,aAAa,MAAA,CAAO,YAAA;AAAA,IACpB,SAAA,EAAW,IAAA,KAAS,WAAA,IAAe,IAAA,KAAS;AAAA,GAC7C,CAAA;AACH,CAAA;AAEO,IAAM,eAAN,MAAmB;AAAA,EAKxB,YAAY,OAAA,EAA8B;AAvK5C,IAAA,IAAA,EAAA,EAAA,EAAA;AAwKI,IAAA,MAAM,YAAqB,OAAA,CAAQ,SAAA;AACnC,IAAA,iBAAA,CAAkB,SAAS,CAAA;AAC3B,IAAA,IAAI,CAAC,OAAA,CAAQ,KAAA,IAAS,OAAO,UAAU,WAAA,EAAa;AAClD,MAAA,MAAM,IAAI,WAAA,CAAY;AAAA,QACpB,IAAA,EAAM,WAAA;AAAA,QACN,IAAA,EAAM,mBAAA;AAAA,QACN,OAAA,EAAS,oDAAA;AAAA,QACT,SAAA,EAAW;AAAA,OACZ,CAAA;AAAA,IACH;AACA,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,IAAA,CAAK,OAAA,GAAU,aAAA,CAAA,CAAc,EAAA,GAAA,OAAA,CAAQ,OAAA,KAAR,YAAmB,gBAAgB,CAAA;AAChE,IAAA,IAAA,CAAK,SAAA,GAAA,CAAY,EAAA,GAAA,OAAA,CAAQ,KAAA,KAAR,IAAA,GAAA,EAAA,GAAiB,KAAA;AAAA,EACpC;AAAA,EAEA,MAAM,YAAA,CACJ,KAAA,GAA2B,EAAC,EAC5B,IAAA,GAAuB,EAAC,EACF;AACtB,IAAA,OAAO,IAAA,CAAK,QAAqB,KAAA,EAAO,WAAA,CAAY,aAAa,KAAK,CAAA,EAAG,QAAW,IAAI,CAAA;AAAA,EAC1F;AAAA,EAGA,MAAM,aAAA,CAAc,IAAA,EAA4B,IAAA,EAA6C;AAC3F,IAAA,OAAO,KAAK,OAAA,CAAiB,MAAA,EAAQ,WAAA,EAAa,IAAA,EAAM,MAAM,IAAI,CAAA;AAAA,EACpE;AAAA,EAEA,MAAM,UAAA,CAAW,SAAA,EAAmB,IAAA,GAAuB,EAAC,EAAqB;AAC/E,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,KAAA;AAAA,MACA,CAAA,UAAA,EAAa,kBAAA,CAAmB,SAAS,CAAC,CAAA,CAAA;AAAA,MAC1C,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EAOA,MAAM,cAAA,CACJ,SAAA,EACA,IAAA,EACA,IAAA,EACkB;AAClB,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,MAAA;AAAA,MACA,CAAA,UAAA,EAAa,kBAAA,CAAmB,SAAS,CAAC,CAAA,QAAA,CAAA;AAAA,MAC1C,IAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EAOA,MAAM,WAAA,CACJ,SAAA,EACA,IAAA,EACA,IAAA,EACkB;AAClB,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,MAAA;AAAA,MACA,CAAA,UAAA,EAAa,kBAAA,CAAmB,SAAS,CAAC,CAAA,KAAA,CAAA;AAAA,MAC1C,IAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EAOA,MAAM,YAAA,CACJ,SAAA,EACA,IAAA,EACA,IAAA,EACiB;AACjB,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,MAAA;AAAA,MACA,CAAA,UAAA,EAAa,kBAAA,CAAmB,SAAS,CAAC,CAAA,QAAA,CAAA;AAAA,MAC1C,IAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EAOA,MAAM,cAAA,CACJ,SAAA,EACA,IAAA,EACA,IAAA,EACiC;AACjC,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,MAAA;AAAA,MACA,CAAA,UAAA,EAAa,kBAAA,CAAmB,SAAS,CAAC,CAAA,QAAA,CAAA;AAAA,MAC1C,IAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EAEA,MAAM,qBAAA,CACJ,SAAA,EACA,IAAA,EACA,IAAA,GAAuB,EAAC,EACS;AACjC,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,MAAA;AAAA,MACA,CAAA,UAAA,EAAa,kBAAA,CAAmB,SAAS,CAAC,CAAA,oBAAA,CAAA;AAAA,MAC1C,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EAEA,MAAM,2BAAA,CACJ,KAAA,EACA,IAAA,GAAuB,EAAC,EACW;AACnC,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,KAAA;AAAA,MACA,WAAA,CAAY,8BAA8B,KAAK,CAAA;AAAA,MAC/C,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EAGA,MAAM,UAAA,CAAW,IAAA,EAAyB,IAAA,EAA0C;AAClF,IAAA,OAAO,KAAK,OAAA,CAAc,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,MAAM,IAAI,CAAA;AAAA,EAC9D;AAAA,EAMA,MAAM,qBAAA,CACJ,IAAA,EACA,IAAA,EAC0B;AAC1B,IAAA,OAAO,KAAK,OAAA,CAAyB,MAAA,EAAQ,oBAAA,EAAsB,IAAA,EAAM,MAAM,IAAI,CAAA;AAAA,EACrF;AAAA,EAEA,MAAc,QACZ,MAAA,EACA,IAAA,EACA,MACA,IAAA,GAA4B,MAAA,EAC5B,qBAAqB,KAAA,EACT;AACZ,IAAA,MAAM,WAAA,GAAc,wBAAwB,IAAI,CAAA;AAChD,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,SAAS,CAAA,CAAA;AAAA,MACvC,uBAAA,EAAyB,WAAA;AAAA,MACzB,cAAA,EAAgB;AAAA,KAClB;AACA,IAAA,IAAI,kBAAA,EAAoB;AACtB,MAAA,OAAA,CAAQ,iBAAiB,CAAA,GAAI,qBAAA,CAAsB,WAAW,CAAA;AAAA,IAChE,CAAA,MAAA,IAAW,WAAA,CAAY,cAAA,KAAmB,MAAA,EAAW;AACnD,MAAA,OAAA,CAAQ,iBAAiB,CAAA,GAAI,qBAAA,CAAsB,WAAW,CAAA;AAAA,IAChE;AAEA,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,KAAK,SAAA,CAAU,CAAA,EAAG,KAAK,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,QACnD,MAAA;AAAA,QACA,OAAA;AAAA,QACA,MAAM,IAAA,KAAS,KAAA,CAAA,GAAY,KAAA,CAAA,GAAY,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,QAC1D,QAAQ,WAAA,CAAY;AAAA,OACrB,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,WAAA,CAAY;AAAA,QACpB,IAAA,EAAM,eAAA;AAAA,QACN,OAAA,EAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,wBAAA;AAAA,QAC9C,SAAA,EAAW;AAAA,OACZ,CAAA;AAAA,IACH;AACA,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,MAAM,MAAM,mBAAmB,GAAG,CAAA;AAC/C,IAAA,OAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,EACzB;AACF;AAEO,IAAM,kBAAA,GAAqB,CAAC,OAAA,KACjC,IAAI,aAAa,OAAO","file":"index.mjs","sourcesContent":["export type ArcPayErrorType =\n  | \"validation_error\"\n  | \"authentication_error\"\n  | \"authorization_error\"\n  | \"state_error\"\n  | \"rate_limit_error\"\n  | \"api_error\"\n  | \"network_error\"\n  | \"challenge_aborted\";\n\nexport interface ArcPayErrorInit {\n  type: ArcPayErrorType;\n  message: string;\n  code?: string;\n  param?: string;\n  paymentId?: string;\n  declineCode?: string;\n  retryable: boolean;\n  requestId?: string;\n}\n\nexport class ArcPayError extends Error {\n  readonly type: ArcPayErrorType;\n  readonly code?: string;\n  readonly param?: string;\n  readonly paymentId?: string;\n  readonly declineCode?: string;\n  readonly retryable: boolean;\n  readonly requestId?: string;\n\n  constructor(init: ArcPayErrorInit) {\n    super(init.message);\n    this.name = \"ArcPayError\";\n    this.type = init.type;\n    this.code = init.code;\n    this.param = init.param;\n    this.paymentId = init.paymentId;\n    this.declineCode = init.declineCode;\n    this.retryable = init.retryable;\n    this.requestId = init.requestId;\n  }\n}\n\nexport const isValidationError = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"validation_error\";\nexport const isAuthenticationError = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"authentication_error\";\nexport const isAuthorizationError = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"authorization_error\";\nexport const isStateError = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"state_error\";\nexport const isRateLimitError = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"rate_limit_error\";\nexport const isApiError = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"api_error\";\nexport const isNetworkError = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"network_error\";\nexport const isChallengeAborted = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"challenge_aborted\";\n","import { ArcPayError, type ArcPayErrorType } from \"../core/errors\";\nimport type {\n  AvailablePaymentMethod,\n  CaptureRequest,\n  CheckoutSession,\n  CompleteThreeDSMethodRequest,\n  CreateCheckoutSessionRequest,\n  CreateLinkRequest,\n  CreatePaymentRequest,\n  CreateRefundRequest,\n  ExecutePaymentRequest,\n  ExecutePaymentResponse,\n  Link,\n  ListAvailablePaymentMethodsQuery,\n  ListPaymentsQuery,\n  Payment,\n  PaymentList,\n  Refund,\n  VoidRequest,\n} from \"./types\";\n\nexport type {\n  AvailablePaymentMethod,\n  CaptureMode,\n  CaptureRequest,\n  CheckoutSession,\n  CompleteThreeDSMethodRequest,\n  CreateCheckoutSessionRequest,\n  CreateLinkRequest,\n  CreatePaymentRequest,\n  CreateRefundRequest,\n  Currency,\n  ExecutePaymentRequest,\n  ExecutePaymentResponse,\n  Link,\n  ListAvailablePaymentMethodsQuery,\n  ListPaymentsQuery,\n  Payment,\n  PaymentFlowMode,\n  PaymentList,\n  PaymentMethod,\n  PaymentStatus,\n  Refund,\n  VoidRequest,\n} from \"./types\";\n\nexport interface ArcPayClientOptions {\n  secretKey: string;\n  apiBase?: string;\n  fetch?: typeof fetch;\n}\n\nexport interface IdempotencyOptions {\n  idempotencyKey: string;\n  signal?: AbortSignal;\n}\n\ntype RequestOptionsInput = RequestOptions | IdempotencyOptions | null | undefined;\n\nexport interface RequestOptions {\n  signal?: AbortSignal;\n}\n\nconst DEFAULT_API_BASE = \"https://api.arcpay.space/v1\";\nconst API_VERSION = \"2026-05-06\";\n\nfunction validateSecretKey(key: unknown): asserts key is string {\n  if (typeof key !== \"string\" || key.length === 0) {\n    throw new ArcPayError({\n      type: \"authentication_error\",\n      code: \"invalid_secret_key\",\n      message: \"Secret key must be a non-empty string\",\n      retryable: false,\n    });\n  }\n  if (!key.startsWith(\"sk_test_\") && !key.startsWith(\"sk_live_\")) {\n    throw new ArcPayError({\n      type: \"authentication_error\",\n      code: \"invalid_secret_key\",\n      message:\n        \"Secret key must start with sk_test_ or sk_live_. Publishable keys cannot call server APIs.\",\n      retryable: false,\n    });\n  }\n}\n\nconst normalizeBase = (base: string): string => base.replace(/\\/+$/, \"\");\n\ninterface RequestOptionsWithOptionalIdempotency extends RequestOptions {\n  idempotencyKey?: string;\n}\n\nconst normalizeRequestOptions = (\n  opts: RequestOptionsInput,\n): RequestOptionsWithOptionalIdempotency => opts ?? {};\n\nconst requireIdempotencyKey = (opts: RequestOptionsWithOptionalIdempotency): string => {\n  if (!opts.idempotencyKey) {\n    throw new ArcPayError({\n      type: \"validation_error\",\n      code: \"missing_idempotency_key\",\n      message: \"idempotencyKey is required for this operation\",\n      retryable: false,\n    });\n  }\n  return opts.idempotencyKey;\n};\n\nconst appendQuery = (path: string, query?: object): string => {\n  if (!query) return path;\n  const params = new URLSearchParams();\n  for (const [key, value] of Object.entries(query)) {\n    if (value === undefined || value === null || value === \"\") continue;\n    params.set(key, String(value));\n  }\n  const encoded = params.toString();\n  return encoded ? `${path}?${encoded}` : path;\n};\n\ninterface APIErrorBody {\n  error?: {\n    type?: string;\n    code?: string;\n    message?: string;\n    param?: string;\n    request_id?: string;\n    decline_code?: string;\n  };\n}\n\nconst isPublicErrorType = (value: unknown): value is ArcPayErrorType =>\n  value === \"validation_error\" ||\n  value === \"authentication_error\" ||\n  value === \"authorization_error\" ||\n  value === \"state_error\" ||\n  value === \"rate_limit_error\" ||\n  value === \"api_error\";\n\nconst parseErrorResponse = async (res: Response): Promise<ArcPayError> => {\n  let body: APIErrorBody = {};\n  try {\n    body = (await res.json()) as APIErrorBody;\n  } catch {\n    /* keep default error below */\n  }\n  const detail = body.error ?? {};\n  const type = isPublicErrorType(detail.type)\n    ? detail.type\n    : res.status >= 500\n      ? \"api_error\"\n      : \"validation_error\";\n  return new ArcPayError({\n    type,\n    code: detail.code,\n    message: detail.message ?? `Request failed with status ${res.status}`,\n    param: detail.param,\n    requestId: detail.request_id,\n    declineCode: detail.decline_code,\n    retryable: type === \"api_error\" || type === \"rate_limit_error\",\n  });\n};\n\nexport class ArcPayClient {\n  private readonly secretKey: string;\n  private readonly apiBase: string;\n  private readonly fetchImpl: typeof fetch;\n\n  constructor(options: ArcPayClientOptions) {\n    const secretKey: unknown = options.secretKey;\n    validateSecretKey(secretKey);\n    if (!options.fetch && typeof fetch === \"undefined\") {\n      throw new ArcPayError({\n        type: \"api_error\",\n        code: \"fetch_unavailable\",\n        message: \"A fetch implementation is required in this runtime\",\n        retryable: false,\n      });\n    }\n    this.secretKey = secretKey;\n    this.apiBase = normalizeBase(options.apiBase ?? DEFAULT_API_BASE);\n    this.fetchImpl = options.fetch ?? fetch;\n  }\n\n  async listPayments(\n    query: ListPaymentsQuery = {},\n    opts: RequestOptions = {},\n  ): Promise<PaymentList> {\n    return this.request<PaymentList>(\"GET\", appendQuery(\"/payments\", query), undefined, opts);\n  }\n\n  async createPayment(body: CreatePaymentRequest, opts: IdempotencyOptions): Promise<Payment>;\n  async createPayment(body: CreatePaymentRequest, opts: RequestOptionsInput): Promise<Payment> {\n    return this.request<Payment>(\"POST\", \"/payments\", body, opts, true);\n  }\n\n  async getPayment(paymentId: string, opts: RequestOptions = {}): Promise<Payment> {\n    return this.request<Payment>(\n      \"GET\",\n      `/payments/${encodeURIComponent(paymentId)}`,\n      undefined,\n      opts,\n    );\n  }\n\n  async capturePayment(\n    paymentId: string,\n    body: CaptureRequest,\n    opts: IdempotencyOptions,\n  ): Promise<Payment>;\n  async capturePayment(\n    paymentId: string,\n    body: CaptureRequest,\n    opts: RequestOptionsInput,\n  ): Promise<Payment> {\n    return this.request<Payment>(\n      \"POST\",\n      `/payments/${encodeURIComponent(paymentId)}/capture`,\n      body,\n      opts,\n      true,\n    );\n  }\n\n  async voidPayment(\n    paymentId: string,\n    body: VoidRequest,\n    opts: IdempotencyOptions,\n  ): Promise<Payment>;\n  async voidPayment(\n    paymentId: string,\n    body: VoidRequest,\n    opts: RequestOptionsInput,\n  ): Promise<Payment> {\n    return this.request<Payment>(\n      \"POST\",\n      `/payments/${encodeURIComponent(paymentId)}/void`,\n      body,\n      opts,\n      true,\n    );\n  }\n\n  async createRefund(\n    paymentId: string,\n    body: CreateRefundRequest,\n    opts: IdempotencyOptions,\n  ): Promise<Refund>;\n  async createRefund(\n    paymentId: string,\n    body: CreateRefundRequest,\n    opts: RequestOptionsInput,\n  ): Promise<Refund> {\n    return this.request<Refund>(\n      \"POST\",\n      `/payments/${encodeURIComponent(paymentId)}/refunds`,\n      body,\n      opts,\n      true,\n    );\n  }\n\n  async executePayment(\n    paymentId: string,\n    body: ExecutePaymentRequest,\n    opts: IdempotencyOptions,\n  ): Promise<ExecutePaymentResponse>;\n  async executePayment(\n    paymentId: string,\n    body: ExecutePaymentRequest,\n    opts: RequestOptionsInput,\n  ): Promise<ExecutePaymentResponse> {\n    return this.request<ExecutePaymentResponse>(\n      \"POST\",\n      `/payments/${encodeURIComponent(paymentId)}/execute`,\n      body,\n      opts,\n      true,\n    );\n  }\n\n  async completeThreeDSMethod(\n    paymentId: string,\n    body: CompleteThreeDSMethodRequest,\n    opts: RequestOptions = {},\n  ): Promise<ExecutePaymentResponse> {\n    return this.request<ExecutePaymentResponse>(\n      \"POST\",\n      `/payments/${encodeURIComponent(paymentId)}/complete-3ds-method`,\n      body,\n      opts,\n    );\n  }\n\n  async listAvailablePaymentMethods(\n    query: ListAvailablePaymentMethodsQuery,\n    opts: RequestOptions = {},\n  ): Promise<AvailablePaymentMethod[]> {\n    return this.request<AvailablePaymentMethod[]>(\n      \"GET\",\n      appendQuery(\"/payment-methods/available\", query),\n      undefined,\n      opts,\n    );\n  }\n\n  async createLink(body: CreateLinkRequest, opts: IdempotencyOptions): Promise<Link>;\n  async createLink(body: CreateLinkRequest, opts: RequestOptionsInput): Promise<Link> {\n    return this.request<Link>(\"POST\", \"/links\", body, opts, true);\n  }\n\n  async createCheckoutSession(\n    body: CreateCheckoutSessionRequest,\n    opts: IdempotencyOptions,\n  ): Promise<CheckoutSession>;\n  async createCheckoutSession(\n    body: CreateCheckoutSessionRequest,\n    opts: RequestOptionsInput,\n  ): Promise<CheckoutSession> {\n    return this.request<CheckoutSession>(\"POST\", \"/checkout/sessions\", body, opts, true);\n  }\n\n  private async request<T>(\n    method: \"GET\" | \"POST\",\n    path: string,\n    body: unknown,\n    opts: RequestOptionsInput = undefined,\n    requireIdempotency = false,\n  ): Promise<T> {\n    const requestOpts = normalizeRequestOptions(opts);\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${this.secretKey}`,\n      \"X-Arc-Pay-API-Version\": API_VERSION,\n      \"Content-Type\": \"application/json\",\n    };\n    if (requireIdempotency) {\n      headers[\"Idempotency-Key\"] = requireIdempotencyKey(requestOpts);\n    } else if (requestOpts.idempotencyKey !== undefined) {\n      headers[\"Idempotency-Key\"] = requireIdempotencyKey(requestOpts);\n    }\n\n    let res: Response;\n    try {\n      res = await this.fetchImpl(`${this.apiBase}${path}`, {\n        method,\n        headers,\n        body: body === undefined ? undefined : JSON.stringify(body),\n        signal: requestOpts.signal,\n      });\n    } catch (err) {\n      throw new ArcPayError({\n        type: \"network_error\",\n        message: err instanceof Error ? err.message : \"Network request failed\",\n        retryable: true,\n      });\n    }\n    if (!res.ok) throw await parseErrorResponse(res);\n    return (await res.json()) as T;\n  }\n}\n\nexport const createArcPayClient = (options: ArcPayClientOptions): ArcPayClient =>\n  new ArcPayClient(options);\n"]}

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@thavguard/arc-pay",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Arc Pay browser SDK — publishable-key tokenization, Hosted Fields, and React bindings",
   "private": false,
-  "license": "UNLICENSED",
+  "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",
   "module": "./dist/index.mjs",
@@ -32,7 +32,8 @@
   },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
   "publishConfig": {
     "registry": "https://registry.npmjs.org/"

package/dist/cdn/arcpay.global.js

@@ -1,3 +0,0 @@
-var ArcPay=(function(exports){'use strict';var o=class extends Error{constructor(t){super(t.message),this.name="ArcPayError",this.type=t.type,this.code=t.code,this.param=t.param,this.paymentId=t.paymentId,this.declineCode=t.declineCode,this.retryable=t.retryable,this.requestId=t.requestId;}},A=e=>e instanceof o&&e.type==="validation_error",I=e=>e instanceof o&&e.type==="authentication_error",S=e=>e instanceof o&&e.type==="authorization_error",z=e=>e instanceof o&&e.type==="state_error",C=e=>e instanceof o&&e.type==="rate_limit_error",R=e=>e instanceof o&&e.type==="api_error",B=e=>e instanceof o&&e.type==="network_error",M=e=>e instanceof o&&e.type==="challenge_aborted";var L=()=>{var t;if(typeof document=="undefined")return null;let e=document.head.querySelector('meta[http-equiv="Content-Security-Policy"]');return (t=e==null?void 0:e.getAttribute("content"))!=null?t:null},F=(e,t)=>{let n=e.toLowerCase().indexOf(`${t} `);if(n===-1)return null;let s=e.slice(n+t.length+1),i=s.indexOf(";");return (i===-1?s:s.slice(0,i)).trim()},O=(e,t)=>{let r=e.split(/\s+/).filter(Boolean);return r.includes("*")?true:r.some(n=>{if(n===t)return  true;if(n.startsWith("https://*")){let s=n.slice(9);return t.endsWith(s)}return  false})},x=e=>{let t=L();if(!t)return;let r=F(t,"connect-src");if(r&&!O(r,e))throw new o({type:"validation_error",code:"csp_blocks_api",message:`CSP connect-src directive does not allow ${e}. Add it to your Content-Security-Policy header.`,retryable:false})};var g=e=>e.startsWith("pk_test_")?"sandbox":"live",w=e=>{if(typeof e!="string"||e.length===0)throw new o({type:"validation_error",code:"invalid_publishable_key",message:"Publishable key must be a non-empty string",retryable:false});if(!e.startsWith("pk_test_")&&!e.startsWith("pk_live_"))throw new o({type:"validation_error",code:"invalid_publishable_key",message:"Publishable key must start with pk_test_ or pk_live_. Secret keys (sk_*) cannot be used in browser.",retryable:false})};var _="data-arcpay-sandbox-banner",T=()=>{if(typeof document=="undefined"||document.querySelector(`[${_}]`))return;let e=document.createElement("div");e.setAttribute(_,""),e.style.cssText="position:fixed;top:0;left:0;right:0;z-index:2147483647;background:#ffd166;color:#222;font:13px/1.4 system-ui,sans-serif;padding:6px 12px;display:flex;align-items:center;justify-content:center;box-shadow:0 1px 3px rgba(0,0,0,0.1);";let t=document.createElement("span");t.textContent="ARC PAY TEST MODE \u2014 payments are simulated",e.appendChild(t);let r=document.createElement("button");r.type="button",r.setAttribute("data-arcpay-banner-dismiss",""),r.textContent="\xD7",r.setAttribute("aria-label","Dismiss test mode banner"),r.style.cssText="margin-left:12px;background:transparent;border:0;font-size:18px;cursor:pointer;color:inherit;",r.addEventListener("click",()=>e.remove()),e.appendChild(r),document.body.appendChild(e);};var W="arcpay:",H=e=>typeof e=="object"&&e!==null&&"type"in e&&typeof e.type=="string"&&e.type.startsWith(W),f=(e,t,r)=>{if(r==="*")throw new o({type:"validation_error",code:"wildcard_origin_forbidden",message:"postToIframe: targetOrigin cannot be '*'",retryable:false});if(!e.contentWindow)throw new o({type:"validation_error",code:"iframe_not_loaded",message:"postToIframe: iframe.contentWindow is null (iframe not mounted)",retryable:false});e.contentWindow.postMessage(t,r);},K=(e,t)=>{if(t==="*")throw new Error("postToParent: targetOrigin cannot be '*'");window.parent.postMessage(e,t);},p=(e,t)=>e.origin!==t||!H(e.data)?null:e.data;var $=new Set(["position","transform","pointer-events","z-index","top","left","right","bottom","inset"]),h=e=>{let t={};for(let[r,n]of Object.entries(e)){let s=r.toLowerCase();$.has(s)||(t[r]=n);}return t},u=e=>{let t={base:h(e.base)};return e.invalid!==void 0&&(t.invalid=h(e.invalid)),e.focus!==void 0&&(t.focus=h(e.focus)),t};var d=class{constructor(t,r,n){this.field=t;this.options=r;this.context=n;this.iframe=null;this.listeners=new Set;this.status="pending";this.messageHandler=null;}mount(t){if(this.iframe)throw new o({type:"validation_error",code:"already_mounted",message:`Element ${this.field} is already mounted`,retryable:false});let r=typeof t=="string"?document.querySelector(t):t;if(!(r instanceof HTMLElement))throw new o({type:"validation_error",code:"mount_target_not_found",message:`mount target not found: ${String(t)}`,retryable:false});let n=document.createElement("iframe");n.src=`${this.context.iframeBase}/iframe/${this.field}`,n.style.cssText="border:0;width:100%;height:100%;display:block;",n.setAttribute("allow","payment"),n.setAttribute("data-arcpay-element",this.field),r.appendChild(n),this.iframe=n;let s=new URL(this.context.iframeBase).origin;this.messageHandler=i=>{var c;if(i.source!==((c=this.iframe)==null?void 0:c.contentWindow))return;let l=p(i,s);l&&this.handleMessage(l);},window.addEventListener("message",this.messageHandler),n.addEventListener("load",()=>{if(!this.iframe)return;let i={type:"arcpay:hello",origin:window.location.origin,publishableKey:this.context.publishableKey,channelId:this.context.channelId};f(this.iframe,i,s);},{once:true});}handleMessage(t){t.type==="arcpay:ready"?(this.status="ready",this.options.style&&this.send({type:"arcpay:style",payload:u(this.options.style)}),this.emit({type:"ready"})):t.type==="arcpay:rejected"?(this.status="error",this.emit({type:"error",reason:t.reason})):t.type==="arcpay:change"&&t.field===this.field&&this.emit({type:"change",isValid:t.isValid,brand:t.brand,lastFour:t.lastFour});}update(t){t.style&&this.send({type:"arcpay:style",payload:u(t.style)});}destroy(){this.iframe&&(this.iframe.remove(),this.iframe=null),this.messageHandler&&(window.removeEventListener("message",this.messageHandler),this.messageHandler=null),this.listeners.clear(),this.status="pending";}on(t,r){return this.listeners.add(r),()=>this.listeners.delete(r)}focus(){this.send({type:"arcpay:focus"});}clear(){this.send({type:"arcpay:clear"});}isReady(){return this.status==="ready"}getIframeContentWindow(){var t,r;return (r=(t=this.iframe)==null?void 0:t.contentWindow)!=null?r:null}send(t){if(!this.iframe)throw new o({type:"validation_error",code:"not_mounted",message:`Element ${this.field} is not mounted`,retryable:false});f(this.iframe,t,new URL(this.context.iframeBase).origin);}emit(t){for(let r of this.listeners)r(t);}};var D="https://sdk.arcpay.space",U=()=>{var e;if(!((e=globalThis.crypto)!=null&&e.randomUUID))throw new o({type:"validation_error",code:"crypto_unavailable",message:"crypto.randomUUID is required for Hosted Fields",retryable:false});return globalThis.crypto.randomUUID()},y=class{constructor(t){this.elementMap=new Map;this.tokenizeInFlight=false;var r;this.publishableKey=t.publishableKey,this.iframeBase=(r=t.iframeBase)!=null?r:D,this.channelId=U();}create(t,r={}){if(this.elementMap.has(t))throw new o({type:"validation_error",code:"duplicate_element",message:`Element for ${t} already created`,retryable:false});let n={iframeBase:this.iframeBase,publishableKey:this.publishableKey,channelId:this.channelId},s=new d(t,r,n);return this.elementMap.set(t,s),s}async tokenize(t,r){if(this.tokenizeInFlight)throw new o({type:"validation_error",code:"tokenize_in_progress",message:"A tokenize() call is already in progress for this Elements instance",retryable:false});let n=this.elementMap.get("cardNumber"),s=this.elementMap.get("cardExpiry"),i=this.elementMap.get("cardCvv");if(!n||!s||!i)throw new o({type:"validation_error",code:"incomplete_elements",message:"All three elements (cardNumber, cardExpiry, cardCvv) must be created and mounted before tokenize()",retryable:false});if(!n.isReady()||!s.isReady()||!i.isReady())throw new o({type:"validation_error",code:"elements_not_ready",message:"Wait for all elements to fire 'ready' event before tokenize()",retryable:false});this.tokenizeInFlight=true;try{return await this.doTokenize(n,t,r)}finally{this.tokenizeInFlight=false;}}doTokenize(t,r,n){let s=new URL(this.iframeBase).origin,i=t.getIframeContentWindow();return new Promise((l,c)=>{let E=window.setTimeout(()=>{window.removeEventListener("message",m),c(new o({type:"network_error",code:"tokenize_timeout",message:"tokenize() timed out after 30 seconds",retryable:true,paymentId:r}));},3e4),m=v=>{if(i!==null&&v.source!==i)return;let a=p(v,s);if(a){if(a.type==="arcpay:tokenize-result")clearTimeout(E),window.removeEventListener("message",m),l({cardTokenId:a.cardTokenId,cardMask:a.cardMask,cardScheme:a.cardScheme,cardBin:a.cardBin,expiresAt:a.expiresAt});else if(a.type==="arcpay:tokenize-error"){clearTimeout(E),window.removeEventListener("message",m);let P=a.errorType==="validation_error"||a.errorType==="api_error"?a.errorType:"api_error";c(new o({type:P,code:a.code,message:a.message,retryable:false,paymentId:r}));}}};window.addEventListener("message",m),t.send({type:"arcpay:tokenize",paymentId:r,idempotencyKey:n});})}destroy(){for(let t of this.elementMap.values())t.destroy();this.elementMap.clear();}};var q=w,k="https://api.arcpay.space",b=new Map,N=(e,t)=>{var n;let r=(n=t.apiBase)!=null?n:k;return x(r),g(e)==="sandbox"&&T(),{publishableKey:e,apiBase:r,environment:g(e),elements:s=>new y({publishableKey:e,iframeBase:s==null?void 0:s.iframeBase})}};function V(e,t={}){var i;try{q(e);}catch(l){return Promise.reject(l)}let r=`${e}|${(i=t.apiBase)!=null?i:k}`,n=b.get(r);if(n)return n;let s=Promise.resolve(N(e,t));return b.set(r,s),s}var j=()=>{b.clear();},Y={load:V,__resetForTests:j};var X=e=>{if(!/^\d+$/.test(e)||/^0+$/.test(e))return  false;let t=0,r=false;for(let n=e.length-1;n>=0;n--){let s=e.charCodeAt(n)-48;r&&(s*=2,s>9&&(s-=9)),t+=s,r=!r;}return t%10===0};var Ee="0.1.0";
-exports.ArcPay=Y;exports.ArcPayError=o;exports.Element=d;exports.Elements=y;exports.SDK_VERSION=Ee;exports.isApiError=R;exports.isAuthenticationError=I;exports.isAuthorizationError=S;exports.isChallengeAborted=M;exports.isNetworkError=B;exports.isRateLimitError=C;exports.isStateError=z;exports.isValidationError=A;exports.luhnCheck=X;exports.parseIncoming=p;exports.postToIframe=f;exports.postToParent=K;exports.sanitizeStyle=u;return exports;})({});//# sourceMappingURL=arcpay.global.js.map
-//# sourceMappingURL=arcpay.global.js.map

package/dist/cdn/arcpay.global.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/core/errors.ts","../../src/core/csp.ts","../../src/core/env.ts","../../src/core/sandbox-banner.ts","../../src/elements/postmessage.ts","../../src/elements/style.ts","../../src/elements/element.ts","../../src/elements/elements.ts","../../src/core/arcpay.ts","../../src/tokenize/luhn.ts","../../src/index.ts"],"names":["ArcPayError","init","isValidationError","isAuthenticationError","isAuthorizationError","isStateError","isRateLimitError","isApiError","isNetworkError","isChallengeAborted","readCspContent","_a","meta","extractDirective","csp","name","idx","rest","end","directiveAllowsHost","directive","host","tokens","t","suffix","verifyCspAllowsApiBase","apiBase","detectEnvironment","publishableKey","validatePublishableKey","key","BANNER_ATTR","showSandboxBanner","bar","text","dismiss","ARCPAY_TYPE_PREFIX","isArcpayMessage","data","postToIframe","iframe","message","targetOrigin","postToParent","parseIncoming","event","expectedOrigin","FORBIDDEN_PROPERTIES","sanitizeBlock","block","out","value","normalizedKey","sanitizeStyle","style","result","Element","field","options","context","target","container","hello","_event","callback","_b","listener","DEFAULT_IFRAME_BASE","createChannelId","Elements","opts","ctx","element","paymentId","idempotencyKey","cardNumber","cardExpiry","cardCvv","iframeOrigin","cardIframeWindow","resolve","reject","timer","onMessage","errType","el","DEFAULT_API_BASE","cache","buildInstance","elemOpts","load","err","existing","promise","resetForTests","ArcPay","luhnCheck","pan","sum","alternate","i","n","SDK_VERSION"],"mappings":"2CAqBO,IAAMA,CAAAA,CAAN,cAA0B,KAAM,CASrC,YAAYC,CAAAA,CAAuB,CACjC,MAAMA,CAAAA,CAAK,OAAO,EAClB,IAAA,CAAK,IAAA,CAAO,cACZ,IAAA,CAAK,IAAA,CAAOA,EAAK,IAAA,CACjB,IAAA,CAAK,IAAA,CAAOA,CAAAA,CAAK,IAAA,CACjB,IAAA,CAAK,MAAQA,CAAAA,CAAK,KAAA,CAClB,KAAK,SAAA,CAAYA,CAAAA,CAAK,UACtB,IAAA,CAAK,WAAA,CAAcA,CAAAA,CAAK,WAAA,CACxB,IAAA,CAAK,SAAA,CAAYA,EAAK,SAAA,CACtB,IAAA,CAAK,UAAYA,CAAAA,CAAK,UACxB,CACF,CAAA,CAEaC,CAAAA,CAAqB,CAAA,EAChC,CAAA,YAAaF,CAAAA,EAAe,CAAA,CAAE,OAAS,kBAAA,CAC5BG,CAAAA,CAAyB,GACpC,CAAA,YAAaH,CAAAA,EAAe,EAAE,IAAA,GAAS,sBAAA,CAC5BI,CAAAA,CAAwB,CAAA,EACnC,CAAA,YAAaJ,CAAAA,EAAe,EAAE,IAAA,GAAS,qBAAA,CAC5BK,EAAgB,CAAA,EAC3B,CAAA,YAAaL,GAAe,CAAA,CAAE,IAAA,GAAS,aAAA,CAC5BM,CAAAA,CAAoB,CAAA,EAC/B,CAAA,YAAaN,GAAe,CAAA,CAAE,IAAA,GAAS,mBAC5BO,CAAAA,CAAc,CAAA,EACzB,aAAaP,CAAAA,EAAe,CAAA,CAAE,IAAA,GAAS,WAAA,CAC5BQ,CAAAA,CAAkB,CAAA,EAC7B,aAAaR,CAAAA,EAAe,CAAA,CAAE,OAAS,eAAA,CAC5BS,CAAAA,CAAsB,GACjC,CAAA,YAAaT,CAAAA,EAAe,CAAA,CAAE,IAAA,GAAS,oBCxDzC,IAAMU,EAAiB,IAAqB,CAF5C,IAAAC,CAAAA,CAGE,GAAI,OAAO,QAAA,EAAa,WAAA,CAAa,OAAO,IAAA,CAC5C,IAAMC,EAAO,QAAA,CAAS,IAAA,CAAK,cACzB,4CACF,CAAA,CACA,QAAOD,CAAAA,CAAAC,CAAAA,EAAA,IAAA,CAAA,MAAA,CAAAA,CAAAA,CAAM,YAAA,CAAa,SAAA,CAAA,GAAnB,KAAAD,CAAAA,CAAiC,IAC1C,EAEME,CAAAA,CAAmB,CAACC,EAAaC,CAAAA,GAAgC,CAErE,IAAMC,CAAAA,CADQF,CAAAA,CAAI,WAAA,GACA,OAAA,CAAQ,CAAA,EAAGC,CAAI,CAAA,CAAA,CAAG,CAAA,CACpC,GAAIC,CAAAA,GAAQ,EAAA,CAAI,OAAO,IAAA,CACvB,IAAMC,CAAAA,CAAOH,EAAI,KAAA,CAAME,CAAAA,CAAMD,EAAK,MAAA,CAAS,CAAC,EACtCG,CAAAA,CAAMD,CAAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,CAC5B,OAAA,CAAQC,IAAQ,EAAA,CAAKD,CAAAA,CAAOA,EAAK,KAAA,CAAM,CAAA,CAAGC,CAAG,CAAA,EAAG,IAAA,EAClD,CAAA,CAEMC,CAAAA,CAAsB,CAACC,EAAmBC,CAAAA,GAA0B,CACxE,IAAMC,CAAAA,CAASF,CAAAA,CAAU,MAAM,KAAK,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CACpD,OAAIE,EAAO,QAAA,CAAS,GAAG,EAAU,IAAA,CAC1BA,CAAAA,CAAO,KAAMC,CAAAA,EAAM,CACxB,GAAIA,CAAAA,GAAMF,CAAAA,CAAM,OAAO,MACvB,GAAIE,CAAAA,CAAE,WAAW,WAAW,CAAA,CAAG,CAC7B,IAAMC,CAAAA,CAASD,EAAE,KAAA,CAAM,CAAkB,EACzC,OAAOF,CAAAA,CAAK,SAASG,CAAM,CAC7B,CACA,OAAO,MACT,CAAC,CACH,CAAA,CAEaC,CAAAA,CAA0BC,GAA0B,CAC/D,IAAMZ,EAAMJ,CAAAA,EAAe,CAC3B,GAAI,CAACI,CAAAA,CAAK,OACV,IAAMM,CAAAA,CAAYP,CAAAA,CAAiBC,EAAK,aAAa,CAAA,CACrD,GAAKM,CAAAA,EACD,CAAAD,EAAoBC,CAAAA,CAAWM,CAAO,CAAA,CAC1C,MAAM,IAAI1B,CAAAA,CAAY,CACpB,IAAA,CAAM,kBAAA,CACN,KAAM,gBAAA,CACN,OAAA,CAAS,4CAA4C0B,CAAO,CAAA,gDAAA,CAAA,CAC5D,SAAA,CAAW,KACb,CAAC,CACH,ECxCO,IAAMC,CAAAA,CAAqBC,GAChCA,CAAAA,CAAe,UAAA,CAAW,UAAU,CAAA,CAAI,SAAA,CAAY,MAAA,CAEzCC,CAAAA,CAA0BC,CAAAA,EAAwC,CAC7E,GAAI,OAAOA,CAAAA,EAAQ,UAAYA,CAAAA,CAAI,MAAA,GAAW,EAC5C,MAAM,IAAI9B,CAAAA,CAAY,CACpB,IAAA,CAAM,kBAAA,CACN,KAAM,yBAAA,CACN,OAAA,CAAS,6CACT,SAAA,CAAW,KACb,CAAC,CAAA,CAEH,GAAI,CAAC8B,CAAAA,CAAI,UAAA,CAAW,UAAU,GAAK,CAACA,CAAAA,CAAI,WAAW,UAAU,CAAA,CAC3D,MAAM,IAAI9B,CAAAA,CAAY,CACpB,IAAA,CAAM,kBAAA,CACN,KAAM,yBAAA,CACN,OAAA,CACE,sGACF,SAAA,CAAW,KACb,CAAC,CAEL,CAAA,CCzBA,IAAM+B,CAAAA,CAAc,4BAAA,CAEPC,CAAAA,CAAoB,IAAY,CAE3C,GADI,OAAO,QAAA,EAAa,WAAA,EACpB,SAAS,aAAA,CAAc,CAAA,CAAA,EAAID,CAAW,CAAA,CAAA,CAAG,CAAA,CAAG,OAEhD,IAAME,CAAAA,CAAM,QAAA,CAAS,cAAc,KAAK,CAAA,CACxCA,EAAI,YAAA,CAAaF,CAAAA,CAAa,EAAE,CAAA,CAChCE,CAAAA,CAAI,KAAA,CAAM,QACR,uOAAA,CAEF,IAAMC,EAAO,QAAA,CAAS,aAAA,CAAc,MAAM,CAAA,CAC1CA,CAAAA,CAAK,WAAA,CAAc,iDAAA,CACnBD,CAAAA,CAAI,WAAA,CAAYC,CAAI,CAAA,CAEpB,IAAMC,EAAU,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA,CAC/CA,CAAAA,CAAQ,IAAA,CAAO,QAAA,CACfA,CAAAA,CAAQ,YAAA,CAAa,6BAA8B,EAAE,CAAA,CACrDA,EAAQ,WAAA,CAAc,MAAA,CACtBA,EAAQ,YAAA,CAAa,YAAA,CAAc,0BAA0B,CAAA,CAC7DA,CAAAA,CAAQ,KAAA,CAAM,QACZ,+FAAA,CACFA,CAAAA,CAAQ,iBAAiB,OAAA,CAAS,IAAMF,EAAI,MAAA,EAAQ,CAAA,CACpDA,CAAAA,CAAI,WAAA,CAAYE,CAAO,EAEvB,QAAA,CAAS,IAAA,CAAK,YAAYF,CAAG,EAC/B,ECaA,IAAMG,CAAAA,CAAqB,UAErBC,CAAAA,CAAmBC,CAAAA,EACvB,OAAOA,CAAAA,EAAS,QAAA,EAChBA,IAAS,IAAA,EACT,MAAA,GAAUA,GACV,OAAQA,CAAAA,CAA2B,IAAA,EAAS,QAAA,EAC3CA,CAAAA,CAA0B,IAAA,CAAK,WAAWF,CAAkB,CAAA,CAElDG,EAAe,CAC1BC,CAAAA,CACAC,EACAC,CAAAA,GACS,CACT,GAAIA,CAAAA,GAAiB,GAAA,CACnB,MAAM,IAAI1C,CAAAA,CAAY,CACpB,KAAM,kBAAA,CACN,IAAA,CAAM,4BACN,OAAA,CAAS,0CAAA,CACT,SAAA,CAAW,KACb,CAAC,CAAA,CAEH,GAAI,CAACwC,CAAAA,CAAO,cACV,MAAM,IAAIxC,EAAY,CACpB,IAAA,CAAM,kBAAA,CACN,IAAA,CAAM,mBAAA,CACN,OAAA,CAAS,kEACT,SAAA,CAAW,KACb,CAAC,CAAA,CAEHwC,CAAAA,CAAO,cAAc,WAAA,CAAYC,CAAAA,CAASC,CAAY,EACxD,CAAA,CAEaC,CAAAA,CAAe,CAACF,CAAAA,CAAyBC,CAAAA,GAA+B,CACnF,GAAIA,CAAAA,GAAiB,IACnB,MAAM,IAAI,KAAA,CAAM,0CAA0C,CAAA,CAE5D,MAAA,CAAO,OAAO,WAAA,CAAYD,CAAAA,CAASC,CAAY,EACjD,CAAA,CAEaE,EAAgB,CAC3BC,CAAAA,CACAC,CAAAA,GAEID,CAAAA,CAAM,MAAA,GAAWC,CAAAA,EACjB,CAACT,CAAAA,CAAgBQ,CAAAA,CAAM,IAAI,CAAA,CAAU,IAAA,CAClCA,EAAM,KC9Ef,IAAME,EAAuB,IAAI,GAAA,CAAI,CACnC,UAAA,CACA,WAAA,CACA,iBACA,SAAA,CACA,KAAA,CACA,OACA,OAAA,CACA,QAAA,CACA,OACF,CAAC,CAAA,CAEKC,CAAAA,CAAiBC,GAA0D,CAC/E,IAAMC,EAA8B,EAAC,CACrC,OAAW,CAACpB,CAAAA,CAAKqB,CAAK,CAAA,GAAK,MAAA,CAAO,OAAA,CAAQF,CAAK,CAAA,CAAG,CAChD,IAAMG,CAAAA,CAAgBtB,CAAAA,CAAI,aAAY,CAClCiB,CAAAA,CAAqB,GAAA,CAAIK,CAAa,CAAA,GAI1CF,CAAAA,CAAIpB,CAAG,CAAA,CAAIqB,CAAAA,EACb,CACA,OAAOD,CACT,EAEaG,CAAAA,CAAiBC,CAAAA,EAAoC,CAChE,IAAMC,CAAAA,CAAsB,CAAE,KAAMP,CAAAA,CAAcM,CAAAA,CAAM,IAAI,CAAE,CAAA,CAC9D,OAAIA,CAAAA,CAAM,OAAA,GAAY,MAAA,GAAWC,CAAAA,CAAO,OAAA,CAAUP,CAAAA,CAAcM,EAAM,OAAO,CAAA,CAAA,CACzEA,EAAM,KAAA,GAAU,MAAA,GAAWC,EAAO,KAAA,CAAQP,CAAAA,CAAcM,CAAAA,CAAM,KAAK,CAAA,CAAA,CAChEC,CACT,ECPO,IAAMC,CAAAA,CAAN,KAAc,CAMnB,WAAA,CACkBC,EACCC,CAAAA,CACAC,CAAAA,CACjB,CAHgB,IAAA,CAAA,KAAA,CAAAF,CAAAA,CACC,IAAA,CAAA,OAAA,CAAAC,EACA,IAAA,CAAA,OAAA,CAAAC,CAAAA,CARnB,KAAQ,MAAA,CAAmC,IAAA,CAC3C,KAAiB,SAAA,CAAY,IAAI,IACjC,IAAA,CAAQ,MAAA,CAAwC,UAChD,IAAA,CAAQ,cAAA,CAAqD,KAM1D,CAEH,KAAA,CAAMC,EAAoC,CACxC,GAAI,IAAA,CAAK,MAAA,CACP,MAAM,IAAI5D,EAAY,CACpB,IAAA,CAAM,mBACN,IAAA,CAAM,iBAAA,CACN,QAAS,CAAA,QAAA,EAAW,IAAA,CAAK,KAAK,CAAA,mBAAA,CAAA,CAC9B,SAAA,CAAW,KACb,CAAC,CAAA,CAEH,IAAM6D,EAAY,OAAOD,CAAAA,EAAW,SAAW,QAAA,CAAS,aAAA,CAAcA,CAAM,CAAA,CAAIA,CAAAA,CAChF,GAAI,EAAEC,CAAAA,YAAqB,WAAA,CAAA,CACzB,MAAM,IAAI7D,CAAAA,CAAY,CACpB,IAAA,CAAM,kBAAA,CACN,IAAA,CAAM,wBAAA,CACN,OAAA,CAAS,CAAA,wBAAA,EAA2B,OAAO4D,CAAM,CAAC,GAClD,SAAA,CAAW,KACb,CAAC,CAAA,CAGH,IAAMpB,CAAAA,CAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,EAC9CA,CAAAA,CAAO,GAAA,CAAM,GAAG,IAAA,CAAK,OAAA,CAAQ,UAAU,CAAA,QAAA,EAAW,IAAA,CAAK,KAAK,CAAA,CAAA,CAC5DA,CAAAA,CAAO,KAAA,CAAM,QAAU,gDAAA,CACvBA,CAAAA,CAAO,aAAa,OAAA,CAAS,SAAS,EACtCA,CAAAA,CAAO,YAAA,CAAa,qBAAA,CAAuB,IAAA,CAAK,KAAK,CAAA,CACrDqB,EAAU,WAAA,CAAYrB,CAAM,EAC5B,IAAA,CAAK,MAAA,CAASA,EAEd,IAAMM,CAAAA,CAAiB,IAAI,GAAA,CAAI,IAAA,CAAK,OAAA,CAAQ,UAAU,CAAA,CAAE,MAAA,CAExD,KAAK,cAAA,CAAkBD,CAAAA,EAAwB,CAvEnD,IAAAlC,CAAAA,CA2EM,GAAIkC,CAAAA,CAAM,MAAA,IAAA,CAAWlC,CAAAA,CAAA,KAAK,MAAA,GAAL,IAAA,CAAA,MAAA,CAAAA,EAAa,aAAA,CAAA,CAAe,OAEjD,IAAM2B,CAAAA,CAAOM,CAAAA,CAA8BC,CAAAA,CAAOC,CAAc,CAAA,CAC3DR,CAAAA,EACL,KAAK,aAAA,CAAcA,CAAI,EACzB,CAAA,CACA,MAAA,CAAO,iBAAiB,SAAA,CAAW,IAAA,CAAK,cAAc,CAAA,CAEtDE,CAAAA,CAAO,gBAAA,CACL,OACA,IAAM,CACJ,GAAI,CAAC,IAAA,CAAK,OAAQ,OAClB,IAAMsB,CAAAA,CAAwB,CAC5B,IAAA,CAAM,cAAA,CACN,OAAQ,MAAA,CAAO,QAAA,CAAS,OACxB,cAAA,CAAgB,IAAA,CAAK,QAAQ,cAAA,CAC7B,SAAA,CAAW,IAAA,CAAK,OAAA,CAAQ,SAC1B,CAAA,CACAvB,EAAa,IAAA,CAAK,MAAA,CAAQuB,EAAOhB,CAAc,EACjD,EACA,CAAE,IAAA,CAAM,IAAK,CACf,EACF,CAEQ,cAAcR,CAAAA,CAA4B,CAC5CA,EAAK,IAAA,GAAS,cAAA,EAChB,KAAK,MAAA,CAAS,OAAA,CAEV,IAAA,CAAK,OAAA,CAAQ,KAAA,EACf,IAAA,CAAK,KAAK,CAAE,IAAA,CAAM,eAAgB,OAAA,CAASe,CAAAA,CAAc,KAAK,OAAA,CAAQ,KAAK,CAAE,CAAC,CAAA,CAEhF,KAAK,IAAA,CAAK,CAAE,KAAM,OAAQ,CAAC,GAClBf,CAAAA,CAAK,IAAA,GAAS,iBAAA,EACvB,IAAA,CAAK,MAAA,CAAS,OAAA,CACd,KAAK,IAAA,CAAK,CAAE,KAAM,OAAA,CAAS,MAAA,CAAQA,EAAK,MAAO,CAAC,CAAA,EACvCA,CAAAA,CAAK,IAAA,GAAS,eAAA,EAAmBA,EAAK,KAAA,GAAU,IAAA,CAAK,OAC9D,IAAA,CAAK,IAAA,CAAK,CACR,IAAA,CAAM,QAAA,CACN,OAAA,CAASA,CAAAA,CAAK,OAAA,CACd,KAAA,CAAOA,EAAK,KAAA,CACZ,QAAA,CAAUA,EAAK,QACjB,CAAC,EAGL,CAEA,MAAA,CAAOoB,CAAAA,CAAwC,CACzCA,CAAAA,CAAQ,KAAA,EACV,KAAK,IAAA,CAAK,CAAE,KAAM,cAAA,CAAgB,OAAA,CAASL,EAAcK,CAAAA,CAAQ,KAAK,CAAE,CAAC,EAE7E,CAEA,SAAgB,CACV,IAAA,CAAK,SACP,IAAA,CAAK,MAAA,CAAO,QAAO,CACnB,IAAA,CAAK,MAAA,CAAS,IAAA,CAAA,CAEZ,IAAA,CAAK,cAAA,GACP,OAAO,mBAAA,CAAoB,SAAA,CAAW,KAAK,cAAc,CAAA,CACzD,KAAK,cAAA,CAAiB,IAAA,CAAA,CAExB,IAAA,CAAK,SAAA,CAAU,KAAA,EAAM,CACrB,KAAK,MAAA,CAAS,UAChB,CAEA,EAAA,CAAGK,CAAAA,CAAsCC,EAAgC,CACvE,OAAA,IAAA,CAAK,UAAU,GAAA,CAAIA,CAAQ,EACpB,IAAM,IAAA,CAAK,UAAU,MAAA,CAAOA,CAAQ,CAC7C,CAEA,KAAA,EAAc,CACZ,IAAA,CAAK,IAAA,CAAK,CAAE,KAAM,cAAe,CAAC,EACpC,CAEA,KAAA,EAAc,CACZ,IAAA,CAAK,IAAA,CAAK,CAAE,IAAA,CAAM,cAAe,CAAC,EACpC,CAEA,OAAA,EAAmB,CACjB,OAAO,IAAA,CAAK,SAAW,OACzB,CAOA,sBAAA,EAAwC,CAlK1C,IAAArD,CAAAA,CAAAsD,EAmKI,OAAA,CAAOA,CAAAA,CAAAA,CAAAtD,EAAA,IAAA,CAAK,MAAA,GAAL,YAAAA,CAAAA,CAAa,aAAA,GAAb,IAAA,CAAAsD,CAAAA,CAA8B,IACvC,CAGA,KAAKxB,CAAAA,CAA+B,CAClC,GAAI,CAAC,IAAA,CAAK,OACR,MAAM,IAAIzC,CAAAA,CAAY,CACpB,IAAA,CAAM,kBAAA,CACN,KAAM,aAAA,CACN,OAAA,CAAS,WAAW,IAAA,CAAK,KAAK,kBAC9B,SAAA,CAAW,KACb,CAAC,CAAA,CAEHuC,CAAAA,CAAa,IAAA,CAAK,OAAQE,CAAAA,CAAS,IAAI,IAAI,IAAA,CAAK,OAAA,CAAQ,UAAU,CAAA,CAAE,MAAM,EAC5E,CAEQ,IAAA,CAAKI,CAAAA,CAA2B,CACtC,IAAA,IAAWqB,CAAAA,IAAY,KAAK,SAAA,CAC1BA,CAAAA,CAASrB,CAAK,EAElB,CACF,EC5KA,IAAMsB,CAAAA,CAAsB,2BAEtBC,CAAAA,CAAkB,IAAc,CAdtC,IAAAzD,CAAAA,CAeE,GAAI,EAAA,CAACA,CAAAA,CAAA,UAAA,CAAW,MAAA,GAAX,IAAA,EAAAA,CAAAA,CAAmB,YACtB,MAAM,IAAIX,EAAY,CACpB,IAAA,CAAM,mBACN,IAAA,CAAM,oBAAA,CACN,OAAA,CAAS,iDAAA,CACT,SAAA,CAAW,KACb,CAAC,CAAA,CAEH,OAAO,WAAW,MAAA,CAAO,UAAA,EAC3B,CAAA,CAEaqE,CAAAA,CAAN,KAAe,CAOpB,WAAA,CAAYC,CAAAA,CAAuD,CANnE,IAAA,CAAiB,UAAA,CAAa,IAAI,GAAA,CAIlC,IAAA,CAAQ,iBAAmB,KAAA,CA/B7B,IAAA3D,CAAAA,CAkCI,IAAA,CAAK,cAAA,CAAiB2D,CAAAA,CAAK,eAC3B,IAAA,CAAK,UAAA,CAAA,CAAa3D,EAAA2D,CAAAA,CAAK,UAAA,GAAL,KAAA3D,CAAAA,CAAmBwD,CAAAA,CACrC,IAAA,CAAK,SAAA,CAAYC,CAAAA,GACnB,CAEA,MAAA,CAAOX,CAAAA,CAAkBC,EAA0B,EAAC,CAAY,CAC9D,GAAI,IAAA,CAAK,UAAA,CAAW,GAAA,CAAID,CAAK,CAAA,CAC3B,MAAM,IAAIzD,CAAAA,CAAY,CACpB,IAAA,CAAM,kBAAA,CACN,KAAM,mBAAA,CACN,OAAA,CAAS,CAAA,YAAA,EAAeyD,CAAK,CAAA,gBAAA,CAAA,CAC7B,SAAA,CAAW,KACb,CAAC,CAAA,CAEH,IAAMc,CAAAA,CAAsB,CAC1B,WAAY,IAAA,CAAK,UAAA,CACjB,eAAgB,IAAA,CAAK,cAAA,CACrB,UAAW,IAAA,CAAK,SAClB,EACMC,CAAAA,CAAU,IAAIhB,EAAQC,CAAAA,CAAOC,CAAAA,CAASa,CAAG,CAAA,CAC/C,OAAA,IAAA,CAAK,UAAA,CAAW,IAAId,CAAAA,CAAOe,CAAO,EAC3BA,CACT,CAEA,MAAM,QAAA,CAASC,CAAAA,CAAmBC,CAAAA,CAAiD,CAEjF,GAAI,IAAA,CAAK,iBACP,MAAM,IAAI1E,EAAY,CACpB,IAAA,CAAM,mBACN,IAAA,CAAM,sBAAA,CACN,OAAA,CAAS,qEAAA,CACT,SAAA,CAAW,KACb,CAAC,CAAA,CAGH,IAAM2E,EAAa,IAAA,CAAK,UAAA,CAAW,IAAI,YAAY,CAAA,CAC7CC,CAAAA,CAAa,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,YAAY,CAAA,CAC7CC,CAAAA,CAAU,KAAK,UAAA,CAAW,GAAA,CAAI,SAAS,CAAA,CAE7C,GAAI,CAACF,CAAAA,EAAc,CAACC,CAAAA,EAAc,CAACC,CAAAA,CACjC,MAAM,IAAI7E,CAAAA,CAAY,CACpB,KAAM,kBAAA,CACN,IAAA,CAAM,qBAAA,CACN,OAAA,CACE,oGAAA,CACF,SAAA,CAAW,KACb,CAAC,CAAA,CAEH,GAAI,CAAC2E,CAAAA,CAAW,SAAQ,EAAK,CAACC,CAAAA,CAAW,OAAA,EAAQ,EAAK,CAACC,EAAQ,OAAA,EAAQ,CACrE,MAAM,IAAI7E,CAAAA,CAAY,CACpB,IAAA,CAAM,kBAAA,CACN,KAAM,oBAAA,CACN,OAAA,CAAS,gEACT,SAAA,CAAW,KACb,CAAC,CAAA,CAGH,IAAA,CAAK,iBAAmB,IAAA,CACxB,GAAI,CACF,OAAO,MAAM,IAAA,CAAK,WAAW2E,CAAAA,CAAYF,CAAAA,CAAWC,CAAc,CACpE,CAAA,OAAE,CACA,IAAA,CAAK,gBAAA,CAAmB,MAC1B,CACF,CAEQ,UAAA,CACNC,EACAF,CAAAA,CACAC,CAAAA,CACyB,CACzB,IAAMI,CAAAA,CAAe,IAAI,GAAA,CAAI,IAAA,CAAK,UAAU,CAAA,CAAE,MAAA,CAGxCC,CAAAA,CAAmBJ,EAAW,sBAAA,EAAuB,CAE3D,OAAO,IAAI,OAAA,CAAwB,CAACK,CAAAA,CAASC,CAAAA,GAAW,CAEtD,IAAMC,CAAAA,CAAQ,MAAA,CAAO,WAAW,IAAM,CACpC,OAAO,mBAAA,CAAoB,SAAA,CAAWC,CAAS,CAAA,CAC/CF,CAAAA,CACE,IAAIjF,CAAAA,CAAY,CACd,IAAA,CAAM,gBACN,IAAA,CAAM,kBAAA,CACN,QAAS,uCAAA,CACT,SAAA,CAAW,KACX,SAAA,CAAAyE,CACF,CAAC,CACH,EACF,CAAA,CAAG,GAAM,CAAA,CAEHU,CAAAA,CAAatC,GAAwB,CAEzC,GAAIkC,IAAqB,IAAA,EAAQlC,CAAAA,CAAM,MAAA,GAAWkC,CAAAA,CAAkB,OAEpE,IAAMzC,EAAOM,CAAAA,CAA8BC,CAAAA,CAAOiC,CAAY,CAAA,CAC9D,GAAKxC,GAEL,GAAIA,CAAAA,CAAK,OAAS,wBAAA,CAChB,YAAA,CAAa4C,CAAK,CAAA,CAClB,MAAA,CAAO,oBAAoB,SAAA,CAAWC,CAAS,EAC/CH,CAAAA,CAAQ,CACN,WAAA,CAAa1C,CAAAA,CAAK,WAAA,CAClB,QAAA,CAAUA,EAAK,QAAA,CACf,UAAA,CAAYA,EAAK,UAAA,CACjB,OAAA,CAASA,EAAK,OAAA,CACd,SAAA,CAAWA,CAAAA,CAAK,SAClB,CAAC,CAAA,CAAA,KAAA,GACQA,EAAK,IAAA,GAAS,uBAAA,CAAyB,CAChD,YAAA,CAAa4C,CAAK,EAClB,MAAA,CAAO,mBAAA,CAAoB,SAAA,CAAWC,CAAS,CAAA,CAC/C,IAAMC,EACJ9C,CAAAA,CAAK,SAAA,GAAc,oBAAsBA,CAAAA,CAAK,SAAA,GAAc,YACxDA,CAAAA,CAAK,SAAA,CACL,WAAA,CACN2C,CAAAA,CACE,IAAIjF,CAAAA,CAAY,CACd,IAAA,CAAMoF,CAAAA,CACN,KAAM9C,CAAAA,CAAK,IAAA,CACX,QAASA,CAAAA,CAAK,OAAA,CACd,SAAA,CAAW,KAAA,CACX,SAAA,CAAAmC,CACF,CAAC,CACH,EACF,EACF,CAAA,CAEA,MAAA,CAAO,iBAAiB,SAAA,CAAWU,CAAS,CAAA,CAC5CR,CAAAA,CAAW,IAAA,CAAK,CAAE,KAAM,iBAAA,CAAmB,SAAA,CAAAF,EAAW,cAAA,CAAAC,CAAe,CAAC,EACxE,CAAC,CACH,CAEA,OAAA,EAAgB,CACd,QAAWW,CAAAA,IAAM,IAAA,CAAK,WAAW,MAAA,EAAO,CACtCA,EAAG,OAAA,EAAQ,CAEb,KAAK,UAAA,CAAW,KAAA,GAClB,CACF,ECtKA,IAAMxD,CAAAA,CAAkEA,CAAAA,CAMlEyD,EAAmB,0BAAA,CASnBC,CAAAA,CAAQ,IAAI,GAAA,CAEZC,CAAAA,CAAgB,CAAC5D,EAAwB0C,CAAAA,GAA4C,CAtB3F,IAAA3D,CAAAA,CAuBE,IAAMe,GAAUf,CAAAA,CAAA2D,CAAAA,CAAK,OAAA,GAAL,IAAA,CAAA3D,CAAAA,CAAgB2E,CAAAA,CAChC,OAAA7D,CAAAA,CAAuBC,CAAO,EAC1BC,CAAAA,CAAkBC,CAAc,IAAM,SAAA,EACxCI,CAAAA,EAAkB,CAEb,CACL,cAAA,CAAAJ,CAAAA,CACA,QAAAF,CAAAA,CACA,WAAA,CAAaC,EAAkBC,CAAc,CAAA,CAC7C,SAAW6D,CAAAA,EAAa,IAAIpB,CAAAA,CAAS,CAAE,cAAA,CAAAzC,CAAAA,CAAgB,WAAY6D,CAAAA,EAAA,IAAA,CAAA,MAAA,CAAAA,EAAU,UAAW,CAAC,CAC3F,CACF,CAAA,CAEA,SAASC,CAAAA,CAAK9D,CAAAA,CAAwB0C,CAAAA,CAA0B,EAAC,CAA4B,CApC7F,IAAA3D,CAAAA,CAqCE,GAAI,CACFkB,CAAAA,CAAuBD,CAAc,EACvC,CAAA,MAAS+D,CAAAA,CAAK,CACZ,OAAO,OAAA,CAAQ,MAAA,CAAOA,CAAG,CAC3B,CACA,IAAM7D,CAAAA,CAAM,CAAA,EAAGF,CAAc,CAAA,CAAA,EAAA,CAAIjB,CAAAA,CAAA2D,CAAAA,CAAK,UAAL,IAAA,CAAA3D,CAAAA,CAAgB2E,CAAgB,CAAA,CAAA,CAC3DM,CAAAA,CAAWL,EAAM,GAAA,CAAIzD,CAAG,CAAA,CAC9B,GAAI8D,CAAAA,CAAU,OAAOA,EACrB,IAAMC,CAAAA,CAAU,QAAQ,OAAA,CAAQL,CAAAA,CAAc5D,EAAgB0C,CAAI,CAAC,CAAA,CACnE,OAAAiB,CAAAA,CAAM,GAAA,CAAIzD,EAAK+D,CAAO,CAAA,CACfA,CACT,CAEA,IAAMC,EAAgB,IAAY,CAChCP,CAAAA,CAAM,KAAA,GACR,CAAA,CAEaQ,EAAS,CACpB,IAAA,CAAAL,EACA,eAAA,CAAiBI,CACnB,ECzDO,IAAME,CAAAA,CAAaC,CAAAA,EAAyB,CAEjD,GADI,CAAC,QAAQ,IAAA,CAAKA,CAAG,GACjB,MAAA,CAAO,IAAA,CAAKA,CAAG,CAAA,CAAG,OAAO,MAAA,CAC7B,IAAIC,CAAAA,CAAM,CAAA,CACNC,EAAY,KAAA,CAChB,IAAA,IAASC,EAAIH,CAAAA,CAAI,MAAA,CAAS,EAAGG,CAAAA,EAAK,CAAA,CAAGA,CAAAA,EAAAA,CAAK,CACxC,IAAIC,CAAAA,CAAIJ,EAAI,UAAA,CAAWG,CAAC,EAAI,EAAA,CACxBD,CAAAA,GACFE,GAAK,CAAA,CACDA,CAAAA,CAAI,CAAA,GAAGA,CAAAA,EAAK,CAAA,CAAA,CAAA,CAElBH,CAAAA,EAAOG,EACPF,CAAAA,CAAY,CAACA,EACf,CACA,OAAOD,EAAM,EAAA,GAAO,CACtB,ECEO,IAAMI,EAAAA,CAAc","file":"arcpay.global.js","sourcesContent":["export type ArcPayErrorType =\n  | \"validation_error\"\n  | \"authentication_error\"\n  | \"authorization_error\"\n  | \"state_error\"\n  | \"rate_limit_error\"\n  | \"api_error\"\n  | \"network_error\"\n  | \"challenge_aborted\";\n\nexport interface ArcPayErrorInit {\n  type: ArcPayErrorType;\n  message: string;\n  code?: string;\n  param?: string;\n  paymentId?: string;\n  declineCode?: string;\n  retryable: boolean;\n  requestId?: string;\n}\n\nexport class ArcPayError extends Error {\n  readonly type: ArcPayErrorType;\n  readonly code?: string;\n  readonly param?: string;\n  readonly paymentId?: string;\n  readonly declineCode?: string;\n  readonly retryable: boolean;\n  readonly requestId?: string;\n\n  constructor(init: ArcPayErrorInit) {\n    super(init.message);\n    this.name = \"ArcPayError\";\n    this.type = init.type;\n    this.code = init.code;\n    this.param = init.param;\n    this.paymentId = init.paymentId;\n    this.declineCode = init.declineCode;\n    this.retryable = init.retryable;\n    this.requestId = init.requestId;\n  }\n}\n\nexport const isValidationError = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"validation_error\";\nexport const isAuthenticationError = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"authentication_error\";\nexport const isAuthorizationError = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"authorization_error\";\nexport const isStateError = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"state_error\";\nexport const isRateLimitError = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"rate_limit_error\";\nexport const isApiError = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"api_error\";\nexport const isNetworkError = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"network_error\";\nexport const isChallengeAborted = (e: unknown): e is ArcPayError =>\n  e instanceof ArcPayError && e.type === \"challenge_aborted\";\n","import { ArcPayError } from \"./errors\";\n\nconst readCspContent = (): string | null => {\n  if (typeof document === \"undefined\") return null;\n  const meta = document.head.querySelector<HTMLMetaElement>(\n    'meta[http-equiv=\"Content-Security-Policy\"]',\n  );\n  return meta?.getAttribute(\"content\") ?? null;\n};\n\nconst extractDirective = (csp: string, name: string): string | null => {\n  const lower = csp.toLowerCase();\n  const idx = lower.indexOf(`${name} `);\n  if (idx === -1) return null;\n  const rest = csp.slice(idx + name.length + 1);\n  const end = rest.indexOf(\";\");\n  return (end === -1 ? rest : rest.slice(0, end)).trim();\n};\n\nconst directiveAllowsHost = (directive: string, host: string): boolean => {\n  const tokens = directive.split(/\\s+/).filter(Boolean);\n  if (tokens.includes(\"*\")) return true;\n  return tokens.some((t) => {\n    if (t === host) return true;\n    if (t.startsWith(\"https://*\")) {\n      const suffix = t.slice(\"https://*\".length);\n      return host.endsWith(suffix);\n    }\n    return false;\n  });\n};\n\nexport const verifyCspAllowsApiBase = (apiBase: string): void => {\n  const csp = readCspContent();\n  if (!csp) return;\n  const directive = extractDirective(csp, \"connect-src\");\n  if (!directive) return;\n  if (directiveAllowsHost(directive, apiBase)) return;\n  throw new ArcPayError({\n    type: \"validation_error\",\n    code: \"csp_blocks_api\",\n    message: `CSP connect-src directive does not allow ${apiBase}. Add it to your Content-Security-Policy header.`,\n    retryable: false,\n  });\n};\n","import { ArcPayError } from \"./errors\";\n\nexport type Environment = \"sandbox\" | \"live\";\n\nexport const detectEnvironment = (publishableKey: string): Environment =>\n  publishableKey.startsWith(\"pk_test_\") ? \"sandbox\" : \"live\";\n\nexport const validatePublishableKey = (key: unknown): asserts key is string => {\n  if (typeof key !== \"string\" || key.length === 0) {\n    throw new ArcPayError({\n      type: \"validation_error\",\n      code: \"invalid_publishable_key\",\n      message: \"Publishable key must be a non-empty string\",\n      retryable: false,\n    });\n  }\n  if (!key.startsWith(\"pk_test_\") && !key.startsWith(\"pk_live_\")) {\n    throw new ArcPayError({\n      type: \"validation_error\",\n      code: \"invalid_publishable_key\",\n      message:\n        \"Publishable key must start with pk_test_ or pk_live_. Secret keys (sk_*) cannot be used in browser.\",\n      retryable: false,\n    });\n  }\n};\n","const BANNER_ATTR = \"data-arcpay-sandbox-banner\";\n\nexport const showSandboxBanner = (): void => {\n  if (typeof document === \"undefined\") return;\n  if (document.querySelector(`[${BANNER_ATTR}]`)) return;\n\n  const bar = document.createElement(\"div\");\n  bar.setAttribute(BANNER_ATTR, \"\");\n  bar.style.cssText =\n    \"position:fixed;top:0;left:0;right:0;z-index:2147483647;background:#ffd166;color:#222;font:13px/1.4 system-ui,sans-serif;padding:6px 12px;display:flex;align-items:center;justify-content:center;box-shadow:0 1px 3px rgba(0,0,0,0.1);\";\n\n  const text = document.createElement(\"span\");\n  text.textContent = \"ARC PAY TEST MODE — payments are simulated\";\n  bar.appendChild(text);\n\n  const dismiss = document.createElement(\"button\");\n  dismiss.type = \"button\";\n  dismiss.setAttribute(\"data-arcpay-banner-dismiss\", \"\");\n  dismiss.textContent = \"×\";\n  dismiss.setAttribute(\"aria-label\", \"Dismiss test mode banner\");\n  dismiss.style.cssText =\n    \"margin-left:12px;background:transparent;border:0;font-size:18px;cursor:pointer;color:inherit;\";\n  dismiss.addEventListener(\"click\", () => bar.remove());\n  bar.appendChild(dismiss);\n\n  document.body.appendChild(bar);\n};\n","import { ArcPayError } from \"../core/errors\";\n\nexport type FieldType = \"cardNumber\" | \"cardExpiry\" | \"cardCvv\";\n\n// Parent → iframe\nexport type ParentToIframe =\n  | { type: \"arcpay:hello\"; origin: string; publishableKey: string; channelId: string }\n  | { type: \"arcpay:style\"; payload: StyleSubset }\n  | { type: \"arcpay:focus\" }\n  | { type: \"arcpay:clear\" }\n  | { type: \"arcpay:tokenize\"; paymentId: string; idempotencyKey: string };\n\n// iframe → parent\nexport type IframeToParent =\n  | { type: \"arcpay:ready\" }\n  | { type: \"arcpay:rejected\"; reason: string }\n  | {\n      type: \"arcpay:change\";\n      field: FieldType;\n      isValid: boolean;\n      brand?: string;\n      lastFour?: string;\n    }\n  | {\n      type: \"arcpay:tokenize-result\";\n      cardTokenId: string;\n      cardMask: string;\n      cardScheme: string;\n      cardBin: string;\n      expiresAt: string;\n    }\n  | { type: \"arcpay:tokenize-error\"; errorType: string; code?: string; message: string };\n\nexport interface StyleSubset {\n  base: Record<string, string>;\n  invalid?: Record<string, string>;\n  focus?: Record<string, string>;\n}\n\nconst ARCPAY_TYPE_PREFIX = \"arcpay:\";\n\nconst isArcpayMessage = (data: unknown): data is { type: string } =>\n  typeof data === \"object\" &&\n  data !== null &&\n  \"type\" in data &&\n  typeof (data as { type: unknown }).type === \"string\" &&\n  (data as { type: string }).type.startsWith(ARCPAY_TYPE_PREFIX);\n\nexport const postToIframe = (\n  iframe: HTMLIFrameElement,\n  message: ParentToIframe,\n  targetOrigin: string,\n): void => {\n  if (targetOrigin === \"*\") {\n    throw new ArcPayError({\n      type: \"validation_error\",\n      code: \"wildcard_origin_forbidden\",\n      message: \"postToIframe: targetOrigin cannot be '*'\",\n      retryable: false,\n    });\n  }\n  if (!iframe.contentWindow) {\n    throw new ArcPayError({\n      type: \"validation_error\",\n      code: \"iframe_not_loaded\",\n      message: \"postToIframe: iframe.contentWindow is null (iframe not mounted)\",\n      retryable: false,\n    });\n  }\n  iframe.contentWindow.postMessage(message, targetOrigin);\n};\n\nexport const postToParent = (message: IframeToParent, targetOrigin: string): void => {\n  if (targetOrigin === \"*\") {\n    throw new Error(\"postToParent: targetOrigin cannot be '*'\");\n  }\n  window.parent.postMessage(message, targetOrigin);\n};\n\nexport const parseIncoming = <T extends { type: string }>(\n  event: MessageEvent,\n  expectedOrigin: string,\n): T | null => {\n  if (event.origin !== expectedOrigin) return null;\n  if (!isArcpayMessage(event.data)) return null;\n  return event.data as T;\n};\n","import type { StyleSubset } from \"./postmessage\";\n\n// Spec calls out position:fixed, transform, pointer-events:none as forbidden.\n// We extend to cover the full clickjacking attack surface: any positioning\n// (fixed/absolute/sticky), transform, all pointer-events values, z-index, and\n// inset properties (top/left/right/bottom/inset). The legitimate use cases\n// for these in a 1-line input field are zero, so blanket drop.\nconst FORBIDDEN_PROPERTIES = new Set([\n  \"position\",\n  \"transform\",\n  \"pointer-events\",\n  \"z-index\",\n  \"top\",\n  \"left\",\n  \"right\",\n  \"bottom\",\n  \"inset\",\n]);\n\nconst sanitizeBlock = (block: Record<string, string>): Record<string, string> => {\n  const out: Record<string, string> = {};\n  for (const [key, value] of Object.entries(block)) {\n    const normalizedKey = key.toLowerCase();\n    if (FORBIDDEN_PROPERTIES.has(normalizedKey)) {\n      // Defense against position/transform-based clickjacking. Silently drop.\n      continue;\n    }\n    out[key] = value;\n  }\n  return out;\n};\n\nexport const sanitizeStyle = (style: StyleSubset): StyleSubset => {\n  const result: StyleSubset = { base: sanitizeBlock(style.base) };\n  if (style.invalid !== undefined) result.invalid = sanitizeBlock(style.invalid);\n  if (style.focus !== undefined) result.focus = sanitizeBlock(style.focus);\n  return result;\n};\n","import { ArcPayError } from \"../core/errors\";\nimport {\n  type FieldType,\n  type ParentToIframe,\n  type IframeToParent,\n  type StyleSubset,\n  postToIframe,\n  parseIncoming,\n} from \"./postmessage\";\nimport { sanitizeStyle } from \"./style\";\n\nexport interface ElementOptions {\n  /** StyleSubset applied via arcpay:style postMessage. */\n  style?: StyleSubset;\n  placeholder?: string;\n}\n\nexport type ElementEvent =\n  | { type: \"ready\" }\n  | { type: \"change\"; isValid: boolean; brand?: string; lastFour?: string }\n  | { type: \"error\"; reason: string };\n\ntype Listener = (event: ElementEvent) => void;\n\nexport interface ElementContext {\n  iframeBase: string;\n  publishableKey: string;\n  channelId: string;\n}\n\nexport class Element {\n  private iframe: HTMLIFrameElement | null = null;\n  private readonly listeners = new Set<Listener>();\n  private status: \"pending\" | \"ready\" | \"error\" = \"pending\";\n  private messageHandler: ((e: MessageEvent) => void) | null = null;\n\n  constructor(\n    public readonly field: FieldType,\n    private readonly options: ElementOptions,\n    private readonly context: ElementContext,\n  ) {}\n\n  mount(target: string | HTMLElement): void {\n    if (this.iframe) {\n      throw new ArcPayError({\n        type: \"validation_error\",\n        code: \"already_mounted\",\n        message: `Element ${this.field} is already mounted`,\n        retryable: false,\n      });\n    }\n    const container = typeof target === \"string\" ? document.querySelector(target) : target;\n    if (!(container instanceof HTMLElement)) {\n      throw new ArcPayError({\n        type: \"validation_error\",\n        code: \"mount_target_not_found\",\n        message: `mount target not found: ${String(target)}`,\n        retryable: false,\n      });\n    }\n\n    const iframe = document.createElement(\"iframe\");\n    iframe.src = `${this.context.iframeBase}/iframe/${this.field}`;\n    iframe.style.cssText = \"border:0;width:100%;height:100%;display:block;\";\n    iframe.setAttribute(\"allow\", \"payment\");\n    iframe.setAttribute(\"data-arcpay-element\", this.field);\n    container.appendChild(iframe);\n    this.iframe = iframe;\n\n    const expectedOrigin = new URL(this.context.iframeBase).origin;\n\n    this.messageHandler = (event: MessageEvent) => {\n      // C1: source guard — only accept messages from this element's own iframe.\n      // Without this, any iframe at the same origin (e.g. cardExpiry, cardCvv)\n      // could trigger handlers on cardNumber and vice-versa.\n      if (event.source !== this.iframe?.contentWindow) return;\n      // C4: use parseIncoming for origin + arcpay: prefix guard.\n      const data = parseIncoming<IframeToParent>(event, expectedOrigin);\n      if (!data) return;\n      this.handleMessage(data);\n    };\n    window.addEventListener(\"message\", this.messageHandler);\n\n    iframe.addEventListener(\n      \"load\",\n      () => {\n        if (!this.iframe) return;\n        const hello: ParentToIframe = {\n          type: \"arcpay:hello\",\n          origin: window.location.origin,\n          publishableKey: this.context.publishableKey,\n          channelId: this.context.channelId,\n        };\n        postToIframe(this.iframe, hello, expectedOrigin);\n      },\n      { once: true },\n    );\n  }\n\n  private handleMessage(data: IframeToParent): void {\n    if (data.type === \"arcpay:ready\") {\n      this.status = \"ready\";\n      // Apply initial style if provided at construction time.\n      if (this.options.style) {\n        this.send({ type: \"arcpay:style\", payload: sanitizeStyle(this.options.style) });\n      }\n      this.emit({ type: \"ready\" });\n    } else if (data.type === \"arcpay:rejected\") {\n      this.status = \"error\";\n      this.emit({ type: \"error\", reason: data.reason });\n    } else if (data.type === \"arcpay:change\" && data.field === this.field) {\n      this.emit({\n        type: \"change\",\n        isValid: data.isValid,\n        brand: data.brand,\n        lastFour: data.lastFour,\n      });\n    }\n    // arcpay:tokenize-result / arcpay:tokenize-error handled by Elements factory (Task 9).\n  }\n\n  update(options: { style?: StyleSubset }): void {\n    if (options.style) {\n      this.send({ type: \"arcpay:style\", payload: sanitizeStyle(options.style) });\n    }\n  }\n\n  destroy(): void {\n    if (this.iframe) {\n      this.iframe.remove();\n      this.iframe = null;\n    }\n    if (this.messageHandler) {\n      window.removeEventListener(\"message\", this.messageHandler);\n      this.messageHandler = null;\n    }\n    this.listeners.clear();\n    this.status = \"pending\";\n  }\n\n  on(_event: \"ready\" | \"change\" | \"error\", callback: Listener): () => void {\n    this.listeners.add(callback);\n    return () => this.listeners.delete(callback);\n  }\n\n  focus(): void {\n    this.send({ type: \"arcpay:focus\" });\n  }\n\n  clear(): void {\n    this.send({ type: \"arcpay:clear\" });\n  }\n\n  isReady(): boolean {\n    return this.status === \"ready\";\n  }\n\n  /**\n   * Internal: returns the iframe's contentWindow for source-filtering in\n   * Elements.doTokenize(). Returns null when the iframe is not yet mounted\n   * or when jsdom has not yet populated contentWindow (test environment).\n   */\n  getIframeContentWindow(): Window | null {\n    return this.iframe?.contentWindow ?? null;\n  }\n\n  /** Internal: used by Elements factory to send tokenize commands. */\n  send(message: ParentToIframe): void {\n    if (!this.iframe) {\n      throw new ArcPayError({\n        type: \"validation_error\",\n        code: \"not_mounted\",\n        message: `Element ${this.field} is not mounted`,\n        retryable: false,\n      });\n    }\n    postToIframe(this.iframe, message, new URL(this.context.iframeBase).origin);\n  }\n\n  private emit(event: ElementEvent): void {\n    for (const listener of this.listeners) {\n      listener(event);\n    }\n  }\n}\n","import { ArcPayError } from \"../core/errors\";\nimport { Element, type ElementContext, type ElementOptions } from \"./element\";\nimport type { FieldType, IframeToParent } from \"./postmessage\";\nimport { parseIncoming } from \"./postmessage\";\nimport type { TokenizeResult } from \"../tokenize/tokenize\";\n\nexport type { TokenizeResult };\n\nexport interface ElementsOptions {\n  iframeBase?: string;\n}\n\nconst DEFAULT_IFRAME_BASE = \"https://sdk.arcpay.space\";\n\nconst createChannelId = (): string => {\n  if (!globalThis.crypto?.randomUUID) {\n    throw new ArcPayError({\n      type: \"validation_error\",\n      code: \"crypto_unavailable\",\n      message: \"crypto.randomUUID is required for Hosted Fields\",\n      retryable: false,\n    });\n  }\n  return globalThis.crypto.randomUUID();\n};\n\nexport class Elements {\n  private readonly elementMap = new Map<FieldType, Element>();\n  private readonly iframeBase: string;\n  private readonly publishableKey: string;\n  private readonly channelId: string;\n  private tokenizeInFlight = false;\n\n  constructor(opts: { publishableKey: string; iframeBase?: string }) {\n    this.publishableKey = opts.publishableKey;\n    this.iframeBase = opts.iframeBase ?? DEFAULT_IFRAME_BASE;\n    this.channelId = createChannelId();\n  }\n\n  create(field: FieldType, options: ElementOptions = {}): Element {\n    if (this.elementMap.has(field)) {\n      throw new ArcPayError({\n        type: \"validation_error\",\n        code: \"duplicate_element\",\n        message: `Element for ${field} already created`,\n        retryable: false,\n      });\n    }\n    const ctx: ElementContext = {\n      iframeBase: this.iframeBase,\n      publishableKey: this.publishableKey,\n      channelId: this.channelId,\n    };\n    const element = new Element(field, options, ctx);\n    this.elementMap.set(field, element);\n    return element;\n  }\n\n  async tokenize(paymentId: string, idempotencyKey: string): Promise<TokenizeResult> {\n    // C2: concurrent-call guard — only one tokenize() may be in-flight at a time.\n    if (this.tokenizeInFlight) {\n      throw new ArcPayError({\n        type: \"validation_error\",\n        code: \"tokenize_in_progress\",\n        message: \"A tokenize() call is already in progress for this Elements instance\",\n        retryable: false,\n      });\n    }\n\n    const cardNumber = this.elementMap.get(\"cardNumber\");\n    const cardExpiry = this.elementMap.get(\"cardExpiry\");\n    const cardCvv = this.elementMap.get(\"cardCvv\");\n\n    if (!cardNumber || !cardExpiry || !cardCvv) {\n      throw new ArcPayError({\n        type: \"validation_error\",\n        code: \"incomplete_elements\",\n        message:\n          \"All three elements (cardNumber, cardExpiry, cardCvv) must be created and mounted before tokenize()\",\n        retryable: false,\n      });\n    }\n    if (!cardNumber.isReady() || !cardExpiry.isReady() || !cardCvv.isReady()) {\n      throw new ArcPayError({\n        type: \"validation_error\",\n        code: \"elements_not_ready\",\n        message: \"Wait for all elements to fire 'ready' event before tokenize()\",\n        retryable: false,\n      });\n    }\n\n    this.tokenizeInFlight = true;\n    try {\n      return await this.doTokenize(cardNumber, paymentId, idempotencyKey);\n    } finally {\n      this.tokenizeInFlight = false;\n    }\n  }\n\n  private doTokenize(\n    cardNumber: Element,\n    paymentId: string,\n    idempotencyKey: string,\n  ): Promise<TokenizeResult> {\n    const iframeOrigin = new URL(this.iframeBase).origin;\n    // C1: obtain reference to the cardNumber iframe's contentWindow before\n    // registering the listener so we can filter by source.\n    const cardIframeWindow = cardNumber.getIframeContentWindow();\n\n    return new Promise<TokenizeResult>((resolve, reject) => {\n      // C3: 30-second timeout — rejects and cleans up if no result arrives.\n      const timer = window.setTimeout(() => {\n        window.removeEventListener(\"message\", onMessage);\n        reject(\n          new ArcPayError({\n            type: \"network_error\",\n            code: \"tokenize_timeout\",\n            message: \"tokenize() timed out after 30 seconds\",\n            retryable: true,\n            paymentId,\n          }),\n        );\n      }, 30_000);\n\n      const onMessage = (event: MessageEvent) => {\n        // C1: source guard — only accept messages from the cardNumber iframe.\n        if (cardIframeWindow !== null && event.source !== cardIframeWindow) return;\n        // C4: use parseIncoming for origin + arcpay: prefix guard.\n        const data = parseIncoming<IframeToParent>(event, iframeOrigin);\n        if (!data) return;\n\n        if (data.type === \"arcpay:tokenize-result\") {\n          clearTimeout(timer);\n          window.removeEventListener(\"message\", onMessage);\n          resolve({\n            cardTokenId: data.cardTokenId,\n            cardMask: data.cardMask,\n            cardScheme: data.cardScheme,\n            cardBin: data.cardBin,\n            expiresAt: data.expiresAt,\n          });\n        } else if (data.type === \"arcpay:tokenize-error\") {\n          clearTimeout(timer);\n          window.removeEventListener(\"message\", onMessage);\n          const errType =\n            data.errorType === \"validation_error\" || data.errorType === \"api_error\"\n              ? data.errorType\n              : \"api_error\";\n          reject(\n            new ArcPayError({\n              type: errType,\n              code: data.code,\n              message: data.message,\n              retryable: false,\n              paymentId,\n            }),\n          );\n        }\n      };\n\n      window.addEventListener(\"message\", onMessage);\n      cardNumber.send({ type: \"arcpay:tokenize\", paymentId, idempotencyKey });\n    });\n  }\n\n  destroy(): void {\n    for (const el of this.elementMap.values()) {\n      el.destroy();\n    }\n    this.elementMap.clear();\n  }\n}\n","import { verifyCspAllowsApiBase } from \"./csp\";\nimport { detectEnvironment, type Environment, validatePublishableKey as _validatePublishableKey } from \"./env\";\nimport { showSandboxBanner } from \"./sandbox-banner\";\nimport { Elements, type ElementsOptions } from \"../elements/elements\";\n\nconst validatePublishableKey: (key: unknown) => asserts key is string = _validatePublishableKey;\n\nexport interface ArcPayLoadOptions {\n  apiBase?: string;\n}\n\nconst DEFAULT_API_BASE = \"https://api.arcpay.space\";\n\nexport interface ArcPayInstance {\n  readonly publishableKey: string;\n  readonly apiBase: string;\n  readonly environment: Environment;\n  elements: (opts?: ElementsOptions) => Elements;\n}\n\nconst cache = new Map<string, Promise<ArcPayInstance>>();\n\nconst buildInstance = (publishableKey: string, opts: ArcPayLoadOptions): ArcPayInstance => {\n  const apiBase = opts.apiBase ?? DEFAULT_API_BASE;\n  verifyCspAllowsApiBase(apiBase);\n  if (detectEnvironment(publishableKey) === \"sandbox\") {\n    showSandboxBanner();\n  }\n  return {\n    publishableKey,\n    apiBase,\n    environment: detectEnvironment(publishableKey),\n    elements: (elemOpts) => new Elements({ publishableKey, iframeBase: elemOpts?.iframeBase }),\n  };\n};\n\nfunction load(publishableKey: string, opts: ArcPayLoadOptions = {}): Promise<ArcPayInstance> {\n  try {\n    validatePublishableKey(publishableKey);\n  } catch (err) {\n    return Promise.reject(err);\n  }\n  const key = `${publishableKey}|${opts.apiBase ?? DEFAULT_API_BASE}`;\n  const existing = cache.get(key);\n  if (existing) return existing;\n  const promise = Promise.resolve(buildInstance(publishableKey, opts));\n  cache.set(key, promise);\n  return promise;\n}\n\nconst resetForTests = (): void => {\n  cache.clear();\n};\n\nexport const ArcPay = {\n  load,\n  __resetForTests: resetForTests,\n};\n","export const luhnCheck = (pan: string): boolean => {\n  if (!/^\\d+$/.test(pan)) return false;\n  if (/^0+$/.test(pan)) return false;\n  let sum = 0;\n  let alternate = false;\n  for (let i = pan.length - 1; i >= 0; i--) {\n    let n = pan.charCodeAt(i) - 48;\n    if (alternate) {\n      n *= 2;\n      if (n > 9) n -= 9;\n    }\n    sum += n;\n    alternate = !alternate;\n  }\n  return sum % 10 === 0;\n};\n","export { ArcPay } from \"./core/arcpay\";\nexport type { ArcPayInstance, ArcPayLoadOptions } from \"./core/arcpay\";\nexport {\n  ArcPayError,\n  isValidationError,\n  isAuthenticationError,\n  isAuthorizationError,\n  isStateError,\n  isRateLimitError,\n  isApiError,\n  isNetworkError,\n  isChallengeAborted,\n} from \"./core/errors\";\nexport type { ArcPayErrorType } from \"./core/errors\";\nexport type { Environment } from \"./core/env\";\nexport type { TokenizeRequest, TokenizeResult } from \"./tokenize/tokenize\";\nexport type { CardScheme } from \"./tokenize/scheme\";\nexport const SDK_VERSION = \"0.1.0\";\n\n// Hosted Fields postMessage protocol\nexport type {\n  FieldType,\n  ParentToIframe,\n  IframeToParent,\n  StyleSubset,\n} from \"./elements/postmessage\";\nexport { postToIframe, postToParent, parseIncoming } from \"./elements/postmessage\";\n\n// Style sanitizer — also used by elements iframe app (defense-in-depth on receipt)\nexport { sanitizeStyle } from \"./elements/style\";\n\n// Hosted Fields — Element class + Elements factory\nexport { Element } from \"./elements/element\";\nexport type { ElementOptions, ElementEvent, ElementContext } from \"./elements/element\";\nexport { Elements } from \"./elements/elements\";\nexport type { ElementsOptions } from \"./elements/elements\";\n\n// Luhn check (used by elements app for card-number validation)\nexport { luhnCheck } from \"./tokenize/luhn\";\n"]}