@agent-cards/checkout 0.18.0 → 0.19.0

package/dist/substitutions.generated.js

@@ -1,17 +1,699 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: a74db713f1742d9bc5dc8efc78b364d2a69b255ee8da7f98345242f02114e6ce
-// src/substitutions.js
+// artifact-sha256: 4079aa7704abbbbec052a96cb73463527ac5d027cd23780305c1e2ac954a5e88
+// src/adyen-jwe.js
+var ADYEN_JWE_HEADER = { alg: "RSA-OAEP-256", enc: "A256GCM", version: "1" };
+var BASE64URL = /^[A-Za-z0-9_-]+$/;
+function isAdyenJweCompact(s) {
+    if (typeof s !== "string" || s.length > 2048)
+        return false;
+    const parts = s.split(".");
+    if (parts.length !== 5)
+        return false;
+    const [header, encryptedKey, iv, ciphertext, tag] = parts;
+    if (!parts.every((p) => p.length > 0 && BASE64URL.test(p)))
+        return false;
+    if (encryptedKey.length !== 342 || iv.length !== 16 || tag.length !== 22)
+        return false;
+    if (ciphertext.length > 1024)
+        return false;
+    return isAdyenJweHeader(header);
+}
+function isAdyenJweHeader(segment) {
+    if (!BASE64URL.test(segment) || segment.length > 128)
+        return false;
+    let parsed;
+    try {
+        parsed = JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(segment.replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0))));
+    }
+    catch {
+        return false;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return false;
+    const obj = parsed;
+    const keys = Object.keys(obj).sort();
+    if (keys.join(",") !== "alg,enc,version")
+        return false;
+    return obj.alg === ADYEN_JWE_HEADER.alg && obj.enc === ADYEN_JWE_HEADER.enc && obj.version === ADYEN_JWE_HEADER.version;
+}
+// src/json-path.js
+var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function isPlainObject(v) {
+    return !!v && typeof v === "object" && !Array.isArray(v);
+}
+var MAX_PATH_STEPS = 16;
+function isJsonPath(path) {
+    return Array.isArray(path) && path.length <= MAX_PATH_STEPS && path.every((step) => typeof step === "string" ? step.length > 0 && !FORBIDDEN_KEYS.has(step) : Number.isSafeInteger(step) && step >= 0);
+}
+function jsonAt(root, path) {
+    let node = root;
+    for (const step of path) {
+        if (typeof step === "string") {
+            if (!isPlainObject(node) || FORBIDDEN_KEYS.has(step) || !Object.prototype.hasOwnProperty.call(node, step))
+                return { found: false };
+        }
+        else if (!Array.isArray(node) || !Number.isSafeInteger(step) || step < 0 || step >= node.length) {
+            return { found: false };
+        }
+        node = node[step];
+    }
+    return { found: true, value: node };
+}
+function roundTrips(parsed, body) {
+    try {
+        return JSON.stringify(parsed) === body;
+    }
+    catch {
+        return false;
+    }
+}
+function sameSteps(a, b) {
+    return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((step, i) => step === b[i]);
+}
+function pathsOverlap(a, b) {
+    const n = Math.min(a.length, b.length);
+    for (let i = 0; i < n; i += 1)
+        if (a[i] !== b[i])
+            return false;
+    return true;
+}
+function describePath(path) {
+    return path.length ? path.map((step) => typeof step === "number" ? `[${step}]` : `.${step}`).join("").replace(/^\./, "") : "(root)";
+}
+// src/substitution-primitives.js
 var SubstitutionError = class extends Error {
     constructor(message) {
         super(message);
         this.name = "SubstitutionError";
     }
 };
-var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
-function isPlainObject(v) {
-    return !!v && typeof v === "object" && !Array.isArray(v);
+var SWAP_MEMBERS = /* @__PURE__ */ new Set(["path", "fields", "remove", "set"]);
+function checkedSet(set, path, names, remove) {
+    if (!Array.isArray(set))
+        throw new SubstitutionError("substitutions.set is not a list");
+    const entries = [...set].map((raw) => {
+        const entry = isPlainObject(raw) ? Object.fromEntries(Object.entries(raw)) : null;
+        if (!entry || Object.keys(entry).sort().join(",") !== "path,value")
+            throw new SubstitutionError("a set entry is not a {path, value}");
+        const at = Array.isArray(entry.path) ? [...entry.path] : entry.path;
+        if (!isJsonPath(at) || at.length === 0 || typeof at[at.length - 1] !== "string")
+            throw new SubstitutionError("refusing set path");
+        const value = entry.value;
+        if (value !== null && !["string", "boolean"].includes(typeof value) && !(typeof value === "number" && Number.isFinite(value))) {
+            throw new SubstitutionError(`the set value at ${describePath(at)} is not a string, number, boolean or null`);
+        }
+        const key = at[at.length - 1];
+        if (sameSteps(at.slice(0, -1), path) && (names.includes(key) || remove.includes(key))) {
+            throw new SubstitutionError(`the set entry at ${describePath(at)} writes over an encrypted field or a removed key`);
+        }
+        return { path: at, value };
+    });
+    for (const [i, a] of entries.entries()) {
+        for (const b of entries.slice(i + 1)) {
+            if (pathsOverlap(a.path, b.path))
+                throw new SubstitutionError(`two set entries write at ${describePath(a.path)}`);
+        }
+    }
+    return entries;
 }
+function swapMerchantHostedFields(body, spec) {
+    if (!isPlainObject(spec))
+        throw new SubstitutionError("refusing a substitution that is not an object");
+    for (const member of Object.keys(spec)) {
+        if (!SWAP_MEMBERS.has(member))
+            throw new SubstitutionError(`unexpected substitution member ${member}`);
+    }
+    const path = Array.isArray(spec.path) ? [...spec.path] : spec.path;
+    const fields = isPlainObject(spec.fields) ? Object.fromEntries(Object.entries(spec.fields)) : null;
+    const remove = Array.isArray(spec.remove) ? [...spec.remove] : spec.remove ?? [];
+    if (!isJsonPath(path))
+        throw new SubstitutionError("refusing substitution path");
+    if (!fields || Object.keys(fields).length === 0)
+        throw new SubstitutionError("substitutions carry no fields");
+    const names = Object.keys(fields);
+    const values = names.map((name) => fields[name]);
+    for (const name of names) {
+        if (FORBIDDEN_KEYS.has(name))
+            throw new SubstitutionError(`refusing substitution field ${name}`);
+        if (!isAdyenJweCompact(fields[name]))
+            throw new SubstitutionError(`substitution for ${name} is not an Adyen JWE`);
+    }
+    if (!Array.isArray(remove))
+        throw new SubstitutionError("substitutions.remove is not a list");
+    for (const key of remove) {
+        if (typeof key !== "string" || !key || FORBIDDEN_KEYS.has(key))
+            throw new SubstitutionError(`refusing removal of ${String(key)}`);
+        if (names.includes(key))
+            throw new SubstitutionError(`substitution field ${key} is also listed for removal`);
+    }
+    if (new Set(remove).size !== remove.length)
+        throw new SubstitutionError("substitutions.remove names a key twice");
+    const set = checkedSet(spec.set ?? [], path, names, remove);
+    if (typeof body !== "string")
+        throw new SubstitutionError("the paused body is not JSON");
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        throw new SubstitutionError("the paused body is not JSON");
+    }
+    if (!isPlainObject(parsed))
+        throw new SubstitutionError("the paused body is not a JSON object");
+    const holder = jsonAt(parsed, path);
+    if (!holder.found || !isPlainObject(holder.value))
+        throw new SubstitutionError(`the paused body has no object at ${describePath(path)}`);
+    const swaps = /* @__PURE__ */ new Map();
+    for (const name of names) {
+        const dummy = Object.prototype.hasOwnProperty.call(holder.value, name) ? holder.value[name] : void 0;
+        if (typeof dummy !== "string")
+            throw new SubstitutionError(`the paused body has no string field ${name} at ${describePath(path)}`);
+        if (!isAdyenJweCompact(dummy))
+            throw new SubstitutionError(`the paused field ${name} is not an Adyen JWE`);
+        if (swaps.has(dummy))
+            throw new SubstitutionError("two paused fields carry the same ciphertext");
+        swaps.set(dummy, fields[name]);
+    }
+    const dummies = [...swaps.keys()];
+    if (new Set(values).size !== values.length || values.some((value) => swaps.has(value))) {
+        throw new SubstitutionError("two ciphertexts in this substitution are the same");
+    }
+    const texts = [...dummies, ...values];
+    for (const a of texts)
+        for (const b of texts)
+            if (a !== b && b.includes(a))
+                throw new SubstitutionError("one ciphertext is part of another");
+    if ((remove.length > 0 || set.length > 0) && !roundTrips(parsed, body)) {
+        throw new SubstitutionError("the paused body does not round-trip through JSON, so it cannot be edited");
+    }
+    for (const entry of set) {
+        const parent = jsonAt(parsed, entry.path.slice(0, -1));
+        if (!parent.found || !isPlainObject(parent.value)) {
+            throw new SubstitutionError(`the paused body has no object at ${describePath(entry.path.slice(0, -1))} to write a value in`);
+        }
+        const key = entry.path[entry.path.length - 1];
+        const current = Object.prototype.hasOwnProperty.call(parent.value, key) ? parent.value[key] : void 0;
+        if (current !== null && typeof current === "object") {
+            throw new SubstitutionError(`refusing to write over the object at ${describePath(entry.path)}`);
+        }
+    }
+    const seen = /* @__PURE__ */ new Set();
+    const pattern = new RegExp(dummies.map((text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|"), "g");
+    const swapped = body.replace(pattern, (text) => {
+        seen.add(text);
+        return swaps.get(text);
+    });
+    if (seen.size !== dummies.length)
+        throw new SubstitutionError("a paused field is not written verbatim in the body");
+    let out;
+    try {
+        out = JSON.parse(swapped);
+    }
+    catch {
+        throw new SubstitutionError("the substituted body is not JSON");
+    }
+    const written = jsonAt(out, path);
+    if (!written.found || !isPlainObject(written.value) || names.some((name) => written.value[name] !== fields[name]) || dummies.some((dummy) => swapped.includes(dummy))) {
+        throw new SubstitutionError(`the substitution did not land at ${describePath(path)}`);
+    }
+    if (remove.length === 0 && set.length === 0)
+        return swapped;
+    for (const key of remove)
+        if (Object.prototype.hasOwnProperty.call(written.value, key))
+            delete written.value[key];
+    for (const entry of set) {
+        const parent = jsonAt(out, entry.path.slice(0, -1));
+        if (!parent.found || !isPlainObject(parent.value))
+            throw new SubstitutionError(`the set entry at ${describePath(entry.path)} did not land`);
+        parent.value[entry.path[entry.path.length - 1]] = entry.value;
+    }
+    return JSON.stringify(out);
+}
+// src/deep-freeze.js
+function deepFreeze(value) {
+    if (value && typeof value === "object" && !Object.isFrozen(value)) {
+        for (const child of Object.values(value))
+            deepFreeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+// src/merchant-amount.js
+function merchantAmountCardPaths(profile) {
+    const source = isPlainObject(profile) ? profile.amountSource : void 0;
+    if (!isPlainObject(source))
+        return [];
+    const rules = [source, isPlainObject(source.afterPayment) ? source.afterPayment : {}].flatMap((stage) => [...Array.isArray(stage.bind) ? stage.bind : [], ...Array.isArray(stage.match) ? stage.match : []]);
+    return rules.flatMap((rule) => isPlainObject(rule) ? [rule.card, rule.whenCard] : []).filter(Array.isArray);
+}
+// src/merchant-profiles.js
+var MERCHANT_HOSTED_PROFILES = /* @__PURE__ */ deepFreeze([
+    {
+        // Read Sep 23, 2026. assets.dunelm.com checkout-page bundle: submitPayment
+        // sends {operationName: 'AdyenPayment', variables: {input: {paymentMethod,
+        // browserInfo, idempotencyKey, amount, order, provisionalOrderId,
+        // shopperInteraction, storePaymentMethod}}, query} through Apollo to the
+        // page config's was.url, https://was.dunelm.com/graphql. The same config
+        // names the client key and environment 'live' (adyen-web 5.31.3). Every other
+        // GraphQL operation shares this endpoint, gift card redemption included, with
+        // its own encrypted fields, so only operationName AdyenPayment is this
+        // profile's card request. Public key read from checkoutshopper-live.adyen.com
+        // on 2026-09-25 (UTC).
+        id: "dunelm_was_graphql",
+        merchant: "Dunelm",
+        status: "observe",
+        origins: [{ checkout: "https://www.dunelm.com", endpoint: "https://was.dunelm.com" }],
+        method: "POST",
+        path: "/graphql",
+        query: {},
+        requires: [{ path: ["operationName"], equals: "AdyenPayment" }],
+        holder: ["variables", "input", "paymentMethod"],
+        fields: {
+            encryptedCardNumber: "encryptedCardNumber",
+            encryptedExpiryMonth: "encryptedExpiryMonth",
+            encryptedExpiryYear: "encryptedExpiryYear",
+            encryptedSecurityCode: "encryptedSecurityCode"
+        },
+        // adyen-web stamps brand from the digits typed into its Card component, the
+        // agent's dummy; Adyen refuses a brand that disagrees with the decrypted card
+        // (422/109) and reads the brand off the card when none is sent.
+        remove: ["brand"],
+        refuse: [
+            { path: ["variables", "input", "storePaymentMethod"], when: "true" },
+            { path: ["variables", "input", "paymentMethod", "storedPaymentMethodId"], when: "present" },
+            { path: ["variables", "input", "paymentMethod", "recurringDetailReference"], when: "present" }
+        ],
+        amount: ["variables", "input", "amount"],
+        // Read Sep 25, 2026 (research amount_source/dunelm). The body names an amount only
+        // when the gift_card flag is on and AdyenOrder answered, and then the card's share,
+        // so the total comes from CheckoutView, the provisional order the page shows and
+        // pays: a GraphQL query on the card request's own URL, told apart by operationName.
+        // prices.total is a GraphQL Float in pounds; the response names no currency and
+        // Dunelm sells only in GBP. After payment the card request's own answer carries
+        // transaction.amount (pounds, unit inferred until a HAR).
+        amountSource: {
+            id: "dunelm_checkout_view",
+            origin: "endpoint",
+            format: "json",
+            responses: [{
+                    method: "POST",
+                    path: "/graphql",
+                    query: {},
+                    request: [{ path: ["operationName"], equals: "CheckoutView" }],
+                    at: ["data", "viewer", "checkoutProvisionalOrder"]
+                }],
+            total: { path: ["prices", "total"], format: "number" },
+            unit: "major",
+            currency: "GBP",
+            bind: [{ source: ["provisionalOrderId"], card: ["variables", "input", "provisionalOrderId"] }],
+            // false means nothing is left for the card (a gift card paid it all).
+            requires: [{ path: ["flags", "paymentRequired"], equals: true }],
+            // A GraphQL error result is not a total, even beside partial data.
+            refuse: [{ path: ["errors"], when: "present", root: true }],
+            maxAgeMs: 9e5,
+            afterPayment: {
+                origin: "endpoint",
+                format: "json",
+                responses: [{
+                        method: "POST",
+                        path: "/graphql",
+                        query: {},
+                        request: [{ path: ["operationName"], equals: "AdyenPayment" }],
+                        at: ["data", "adyenPayment"]
+                    }],
+                total: { path: ["transaction", "amount"], format: "number" },
+                unit: "major",
+                currency: "GBP",
+                bind: [{ request: ["variables", "input", "provisionalOrderId"], card: ["variables", "input", "provisionalOrderId"] }]
+            }
+        },
+        adyen: {
+            environment: "live",
+            clientKey: "live_3APNTGTFX5FENHWGWUJEKGYSKY7YKURV",
+            publicKeySha256: "0fc63087b90dc0958fc2c024aafca1cd8b6feb34b6f53bb19b1b5649f3e6c316"
+        }
+    },
+    {
+        // Read Sep 23, 2026. www.cinemark.com/scripts/app/adyenIntegration.js posts
+        // state.data plus root amount, store and additionalData, through
+        // JSON.stringify, to /api/adyen/initiatePayment (stored cards go to its
+        // sibling initiateStoredPayment), and maps the environment 'live' to
+        // 'live-us'. A card-free observe run on the guest ticket checkout read the
+        // client key from the three securedFields iframes on
+        // checkoutshopper-live-us.adyen.com (adyen-web 6.x). The request body itself
+        // was not captured: the guest email gate stopped the run before Pay. Public
+        // key read from checkoutshopper-live-us.adyen.com on 2026-09-25 (UTC).
+        id: "cinemark_initiate",
+        merchant: "Cinemark",
+        status: "observe",
+        origins: [{ checkout: "https://www.cinemark.com", endpoint: "https://www.cinemark.com" }],
+        method: "POST",
+        path: "/api/adyen/initiatePayment",
+        query: {},
+        requires: [],
+        holder: ["paymentMethod"],
+        fields: {
+            encryptedCardNumber: "encryptedCardNumber",
+            encryptedExpiryMonth: "encryptedExpiryMonth",
+            encryptedExpiryYear: "encryptedExpiryYear",
+            encryptedSecurityCode: "encryptedSecurityCode"
+        },
+        // adyen-web 6.x stamps brand after its bin lookup answers, so a body carries
+        // the dummy's brand on some Pay presses and not others: removed either way.
+        remove: ["brand"],
+        refuse: [
+            { path: ["storePaymentMethod"], when: "true" },
+            { path: ["paymentMethod", "storedPaymentMethodId"], when: "present" },
+            { path: ["paymentMethod", "recurringDetailReference"], when: "present" },
+            // adyenIntegration.js adds additionalData.existingPaymentId only when its
+            // caller passes one to submitCheckout; the guest flow passes none. What it
+            // points at (a stored card, or an earlier payment this one continues) is
+            // unread, so a body that carries one is refused until a card-free capture
+            // shows it.
+            { path: ["additionalData", "existingPaymentId"], when: "present" },
+            // Present only when Cinemark gift cards pay part of the order: the card then pays
+            // only its share, which is not the order's total.
+            { path: ["additionalData", "giftCardAmount"], when: "present" }
+        ],
+        amount: ["amount"],
+        // Read Sep 25, 2026 (research amount_source/cinemark). The body's amount is computed
+        // by the page's script in the agent's browser (total, plus any tip, minus gift
+        // cards); the server renders the total into the checkout HTML, as the hidden input
+        // CartSummary_TotalWithServiceFee (dollars), or the inline var cartTotal when that
+        // input is not there. The page reloads /Checkout after every cart change. The cart
+        // is the session's, so the response is tied to the card request by its page. A
+        // tip makes the body differ from the total and is refused, as the rule for a body
+        // amount beside a source says. After payment, initiatePayment's answer names the
+        // amount (minor units) when Cinemark relays Adyen's response: a HAR confirms it.
+        amountSource: {
+            id: "cinemark_checkout_page_total",
+            origin: "endpoint",
+            format: "html",
+            responses: [
+                { method: "GET", path: "/checkout", query: {} },
+                { method: "GET", path: "/Checkout", query: {} }
+            ],
+            total: { input: "CartSummary_TotalWithServiceFee", scriptVar: "cartTotal", format: "decimal" },
+            unit: "major",
+            currency: "USD",
+            bind: [{ samePage: true }],
+            maxAgeMs: 9e5,
+            afterPayment: {
+                origin: "endpoint",
+                format: "json",
+                responses: [
+                    { method: "POST", path: "/api/adyen/initiatePayment", query: {} },
+                    { method: "POST", path: "/api/adyen/submitAdditionalDetails", query: {} }
+                ],
+                total: { path: ["amount", "value"], format: "number" },
+                unit: "minor",
+                currency: "USD",
+                currencyPath: ["amount", "currency"],
+                bind: [{ samePage: true }]
+            }
+        },
+        adyen: {
+            environment: "live-us",
+            clientKey: "live_AFKCBP443ZGQNIY4OCYW3YCKDY6VIKNN",
+            publicKeySha256: "9dd5ef549c7454d60ca970ff76c8f4cac36d79f2961e59eca9116791e86cbcc5"
+        }
+    },
+    {
+        // Read Sep 23, 2026. payments.dickssportinggoods.com/library/dppjs/index-v2.js
+        // (adyen-web 6.39.0): Dd() builds tenders.encryptedCardTenders[0] from the Card
+        // component's four JWEs as cardNumber, expirationMonth, expirationYear and cvv,
+        // beside cardType (adyen-web's first detected brand), saveForLater (the save-card
+        // box) and vinBalue (the six digits onBinValue reports). The page posts it with
+        // transactionReference, customer.device and any giftCardTenders to
+        // <payments host>/prod/api/paygate/v2/authorization, the host picked from the
+        // page's own (Dick's, Golf Galaxy, Public Lands, Going Going Gone). The same slot
+        // carries Afterpay, CashApp and Affirm tenders with literal strings where the JWEs
+        // go, and a saved card goes to tenders.savedCardTender instead. The body names no
+        // amount: the paygate charges the cart it holds for transactionReference.
+        // mountCCForm names the client key and environment 'live'. Public key read from
+        // checkoutshopper-live.adyen.com on 2026-09-25 (UTC).
+        id: "dsg_paygate_v2",
+        merchant: "Dick's Sporting Goods",
+        status: "observe",
+        origins: [
+            { checkout: "https://www.dickssportinggoods.com", endpoint: "https://payments.dickssportinggoods.com" },
+            { checkout: "https://www.golfgalaxy.com", endpoint: "https://payments.golfgalaxy.com" },
+            { checkout: "https://www.publiclands.com", endpoint: "https://payments.publiclands.com" },
+            { checkout: "https://www.goinggoinggone.com", endpoint: "https://payments.goinggoinggone.com" }
+        ],
+        method: "POST",
+        path: "/prod/api/paygate/v2/authorization",
+        query: {},
+        // The page sends true for every checkout its translator read, the only checkouts
+        // the amount source below maps; a legacy checkout is not this card request.
+        requires: [{ path: ["isModernOrder"], equals: true }],
+        holder: ["tenders", "encryptedCardTenders", 0],
+        fields: {
+            encryptedCardNumber: "cardNumber",
+            encryptedExpiryMonth: "expirationMonth",
+            encryptedExpiryYear: "expirationYear",
+            encryptedSecurityCode: "cvv"
+        },
+        // cardType and vinBalue describe the dummy the agent typed: the facts below
+        // write the approved card's instead, so nothing is removed.
+        remove: [],
+        refuse: [
+            { path: ["tenders", "encryptedCardTenders", 0, "saveForLater"], when: "true" },
+            // A saved card, or a second card tender the Vault never encrypted.
+            { path: ["tenders", "savedCardTender"], when: "present" },
+            { path: ["tenders", "encryptedCardTenders", 1], when: "present" },
+            // A gift card pays part of the order, so the card pays less than the total.
+            { path: ["tenders", "giftCardTenders"], when: "present" }
+        ],
+        amount: null,
+        // Read Sep 25, 2026 (research amount_source/dickssportinggoods). Every checkout call
+        // on the checkout page answers the whole checkout, camelCase on the wire: the page
+        // load's PATCH (or the create), then every address, shipping, promotion, gift card,
+        // tip and ScoreCard change. pricing.totalRemaining is what the card pays, a string
+        // with exactly two decimals ("123.45"; the page itself drops the dot for minor
+        // units). transactionReference is the checkout key, in the body and the URL. After
+        // payment the order submit and the confirmation read return the placed checkout.
+        amountSource: {
+            id: "dsg_checkout_pricing",
+            origin: "checkout",
+            format: "json",
+            responses: [
+                { method: "PATCH", path: "/api/v1/checkouts/:checkoutKey", query: {} },
+                { method: "POST", path: "/api/v1/checkouts", query: {} },
+                { method: "POST", path: "/api/v1/checkouts/:checkoutKey/addresses", queries: [{}, { type: "billing" }, { type: "shipping" }] },
+                { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/shipping/selected/groups/:groupNumber/mode", query: {} },
+                { method: "PUT", path: "/api/v2/checkouts/:checkoutKey/promotion/cart", query: {} },
+                { method: "DELETE", path: "/api/v2/checkouts/:checkoutKey/promotion/cart", query: {} },
+                { method: "POST", path: "/api/v1/checkouts/:checkoutKey/gift-cards", query: {} },
+                { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/gift-cards/:giftCardIndex", query: {} },
+                { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/tip", query: {} },
+                { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/scorecard", query: {} },
+                { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/scorecard", query: {} },
+                { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/v2/gifts", query: {} }
+            ],
+            total: { path: ["pricing", "totalRemaining"], format: "decimal2" },
+            unit: "major",
+            currency: "USD",
+            currencyPath: ["pricing", "currency"],
+            bind: [
+                { source: ["checkoutKey"], card: ["transactionReference"] },
+                { placeholder: "checkoutKey", card: ["transactionReference"] }
+            ],
+            // The order total and the card's share are the same text. Anything that lowers the
+            // share below the total (a gift card, ScoreCard rewards) or lands in only one of them
+            // (a tip, a donation) is refused until a HAR shows which one the charge follows, so
+            // the approved amount and the placed checkout's total read after payment agree.
+            requires: [{ path: ["pricing", "total"], equalsPath: ["pricing", "totalRemaining"] }],
+            refuse: [
+                // A placed checkout is not the one being paid.
+                { path: ["orderPlacedTime"], when: "true" },
+                // Gift cards and a checkout with no address yet (tax not estimated) wait for a HAR.
+                { path: ["payment", "giftCards"], when: "nonEmpty" },
+                { path: ["addresses"], when: "empty" }
+            ],
+            maxAgeMs: 9e5,
+            afterPayment: {
+                origin: "checkout",
+                format: "json",
+                responses: [
+                    { method: "POST", path: "/api/v1/checkouts/:checkoutKey", query: {} },
+                    { method: "GET", path: "/api/v1/checkouts/submitted/:checkoutKey", query: {} }
+                ],
+                // The order total, which the requires rule above held equal to the card's share
+                // before payment. totalRemaining is not read here: after placement it can drop to
+                // what is still unpaid, which would hide a higher charge.
+                total: { path: ["pricing", "total"], format: "decimal2" },
+                unit: "major",
+                currency: "USD",
+                currencyPath: ["pricing", "currency"],
+                bind: [
+                    { source: ["checkoutKey"], card: ["transactionReference"] },
+                    { placeholder: "checkoutKey", card: ["transactionReference"] }
+                ],
+                refuse: [{ path: ["orderPlacedTime"], when: "unset" }]
+            }
+        },
+        facts: [
+            // adyen-web's brand codes, the ones the page's supported list names; Dick's own
+            // private-label (plcc, comc) cards have no Agentcard brand and are refused.
+            {
+                path: ["tenders", "encryptedCardTenders", 0, "cardType"],
+                fact: "brand",
+                map: { visa: "visa", mastercard: "mc", amex: "amex", discover: "discover", diners: "diners", jcb: "jcb" }
+            },
+            { path: ["tenders", "encryptedCardTenders", 0, "vinBalue"], fact: "bin6" }
+        ],
+        adyen: {
+            environment: "live",
+            clientKey: "live_YJLFKT47JJG2RI7QIYX6HTKKDEDOEGOH",
+            publicKeySha256: "da33611149dff3ab715be8671c0550bb8aec6112983b2473db9ee7afb829c110"
+        }
+    }
+]);
+function adyenKeyHost(environment) {
+    return typeof environment === "string" && /^(?:test|live(?:-[a-z]+)?)$/.test(environment) ? `checkoutshopper-${environment}.adyen.com` : null;
+}
+function wireProjection(profiles) {
+    return deepFreeze(profiles.map(({ adyen, ...profile }) => ({
+        ...profile,
+        adyen: { environment: adyen.environment, clientKey: adyen.clientKey, keyHost: adyenKeyHost(adyen.environment) }
+    })));
+}
+var MERCHANT_PROFILE_RECOGNIZERS = /* @__PURE__ */ wireProjection(MERCHANT_HOSTED_PROFILES);
+var MERCHANT_PROFILE_FACT_KINDS = /* @__PURE__ */ deepFreeze(["brand", "bin6", "last4", "masked_last4", "is_amex"]);
+var CARD_BRANDS = /* @__PURE__ */ deepFreeze([
+    "visa",
+    "mastercard",
+    "amex",
+    "discover",
+    "diners",
+    "jcb",
+    "unionpay",
+    "maestro",
+    "mir",
+    "elo",
+    "hipercard",
+    "hiper"
+]);
+var BRAND_CODE = /^[A-Za-z0-9][A-Za-z0-9 ._-]{0,31}$/;
+var MAX_FACTS = 8;
+function factRefusal(entry, i, holder, besideHolder, reviewed) {
+    const label = `fact ${i}`;
+    if (!isPlainObject(entry))
+        return `${label} is not an object`;
+    const members = Object.keys(entry);
+    if (!members.includes("path") || !members.includes("fact") || !members.every((member) => ["path", "fact", "map"].includes(member))) {
+        return `${label} carries members other than path, fact and map`;
+    }
+    if (!MERCHANT_PROFILE_FACT_KINDS.includes(entry.fact))
+        return `${label} names no fact Agentcard lets leave (${String(entry.fact)})`;
+    const path = entry.path;
+    if (!isJsonPath(path) || path.length === 0 || typeof path[path.length - 1] !== "string")
+        return `${label}'s path is not a JSON path ending in a key`;
+    const key = path[path.length - 1];
+    const parent = path.slice(0, -1);
+    const inHolder = sameSteps(parent, holder);
+    if (!inHolder && !(besideHolder && sameSteps(parent, besideHolder) && key !== holder[holder.length - 1])) {
+        return `${label}'s path ${describePath(path)} is neither in the holder nor beside it`;
+    }
+    if (inHolder && reviewed.written.includes(key))
+        return `${label} writes over an encrypted field or a removed key`;
+    if (reviewed.read.some((read) => pathsOverlap(read, path)))
+        return `${label} writes where a body rule reads`;
+    if (entry.fact !== "brand")
+        return members.includes("map") ? `${label}: only a brand fact takes a map` : null;
+    const map = entry.map;
+    if (!isPlainObject(map))
+        return `${label}: a brand fact needs the merchant's brand map`;
+    const pairs = Object.entries(map);
+    if (pairs.length === 0 || !pairs.every(([brand, code]) => CARD_BRANDS.includes(brand) && typeof code === "string" && BRAND_CODE.test(code))) {
+        return `${label}'s brand map is not Agentcard card brands to merchant codes`;
+    }
+    return null;
+}
+function merchantProfileFactsRefusal(profile) {
+    if (!isPlainObject(profile))
+        return "the profile is not an object";
+    const facts = profile.facts;
+    if (facts === void 0)
+        return null;
+    if (!Array.isArray(facts) || facts.length > MAX_FACTS)
+        return `facts is not a list of at most ${MAX_FACTS}`;
+    const holder = profile.holder;
+    if (!isJsonPath(holder))
+        return "the holder is not a JSON path";
+    const besideHolder = holder.length > 0 && typeof holder[holder.length - 1] === "string" ? holder.slice(0, -1) : null;
+    const list = (value) => Array.isArray(value) ? value : [];
+    const reviewed = {
+        written: [...isPlainObject(profile.fields) ? Object.values(profile.fields) : [], ...list(profile.remove)],
+        read: [...list(profile.requires), ...list(profile.refuse)].map((rule) => rule?.path).concat([profile.amount], merchantAmountCardPaths(profile)).filter(Array.isArray)
+    };
+    for (const [i, entry] of facts.entries()) {
+        const refusal = factRefusal(entry, i, holder, besideHolder, reviewed);
+        if (refusal)
+            return refusal;
+        const earlier = facts.slice(0, i).find((other) => isPlainObject(other) && Array.isArray(other.path) && pathsOverlap(other.path, entry.path));
+        if (earlier)
+            return `fact ${i} writes where another fact writes`;
+    }
+    return null;
+}
+function merchantProfileRecognizerById(id) {
+    return typeof id === "string" ? MERCHANT_PROFILE_RECOGNIZERS.find((entry) => entry.id === id) ?? null : null;
+}
+function sameKeyIgnoringCase(key, step) {
+    return !FORBIDDEN_KEYS.has(key) && (key.toLowerCase() === step.toLowerCase() || key.toUpperCase() === step.toUpperCase());
+}
+function valuesIgnoringCase(root, path) {
+    let nodes = [root];
+    for (const step of path) {
+        const next = [];
+        for (const node of nodes) {
+            if (typeof step === "number") {
+                if (Array.isArray(node) && Number.isSafeInteger(step) && step >= 0 && step < node.length)
+                    next.push(node[step]);
+            }
+            else if (isPlainObject(node)) {
+                for (const key of Object.keys(node))
+                    if (sameKeyIgnoringCase(key, step))
+                        next.push(node[key]);
+            }
+        }
+        nodes = next;
+    }
+    return nodes;
+}
+function merchantBodyRefusal(profile, body) {
+    const p = merchantProfileRecognizerById(typeof profile === "string" ? profile : profile?.id);
+    if (!p)
+        throw new Error("Refusing to pay: unknown merchant profile.");
+    let parsed;
+    try {
+        parsed = typeof body === "string" ? JSON.parse(body) : void 0;
+    }
+    catch {
+        return "the paused body is not JSON";
+    }
+    if (!isPlainObject(parsed))
+        return "the paused body is not a JSON object";
+    if (!roundTrips(parsed, body))
+        return "the paused body does not round-trip through JSON, so its rules cannot be read";
+    for (const rule of p.requires) {
+        const at = jsonAt(parsed, rule.path);
+        if (!at.found || at.value !== rule.equals || valuesIgnoringCase(parsed, rule.path).some((value) => value !== rule.equals)) {
+            return `the paused body is not ${p.merchant}'s card request: ${describePath(rule.path)} is not ${JSON.stringify(rule.equals)}`;
+        }
+    }
+    for (const rule of p.refuse) {
+        const values = valuesIgnoringCase(parsed, rule.path);
+        const fires = rule.when === "true" ? values.some((value) => value !== false && value !== null) : values.length > 0;
+        if (fires)
+            return `the paused body asks ${p.merchant} for more than this purchase: ${describePath(rule.path)}`;
+    }
+    return null;
+}
+// src/substitutions.js
 function substituteEncryptedFields(body, sub) {
     if (!sub || sub.encoding !== "json") {
         throw new SubstitutionError(`unsupported substitution encoding: ${String(sub?.encoding)}`);
@@ -63,4 +745,74 @@ function substituteEncryptedFields(body, sub) {
             delete node[key];
     return JSON.stringify(parsed);
 }
-export { SubstitutionError, substituteEncryptedFields };
+var MERCHANT_HOSTED_MEMBERS = /* @__PURE__ */ new Set(["encoding", "kind", "profile", "path", "fields", "remove", "set"]);
+var FACT_VALUE = {
+    brand: (value, fact) => typeof value === "string" && Object.values(fact.map).includes(value),
+    bin6: (value) => typeof value === "string" && /^\d{6}$/.test(value),
+    last4: (value) => typeof value === "string" && /^\d{4}$/.test(value),
+    masked_last4: (value) => typeof value === "string" && /^\*{12}\d{4}$/.test(value),
+    is_amex: (value) => typeof value === "boolean"
+};
+function checkedFactSet(set, facts, merchant) {
+    const list = Array.isArray(set) ? [...set] : null;
+    if (!list || list.length !== facts.length) {
+        throw new SubstitutionError(`the substitution does not carry exactly the card facts ${merchant}'s card request takes`);
+    }
+    return facts.map((fact, i) => {
+        const entry = isPlainObject(list[i]) ? Object.fromEntries(Object.entries(list[i])) : null;
+        if (!entry || Object.keys(entry).sort().join(",") !== "path,value") {
+            throw new SubstitutionError(`card fact ${i} is not a {path, value}`);
+        }
+        if (!sameSteps(entry.path, fact.path)) {
+            throw new SubstitutionError(`card fact ${i} is not at a path ${merchant}'s card request declares`);
+        }
+        if (!Object.prototype.hasOwnProperty.call(FACT_VALUE, fact.fact) || !FACT_VALUE[fact.fact](entry.value, fact)) {
+            throw new SubstitutionError(`card fact ${i} is not a ${fact.fact} value ${merchant} takes`);
+        }
+        return { path: [...fact.path], value: entry.value };
+    });
+}
+function substituteMerchantHosted(body, sub, opts) {
+    if (!isPlainObject(sub) || sub.encoding !== "json") {
+        throw new SubstitutionError(`unsupported substitution encoding: ${String(sub?.encoding)}`);
+    }
+    if (sub.kind !== "merchant_hosted")
+        throw new SubstitutionError(`unsupported substitution kind: ${String(sub.kind)}`);
+    for (const member of Object.keys(sub)) {
+        if (!MERCHANT_HOSTED_MEMBERS.has(member))
+            throw new SubstitutionError(`unexpected substitution member ${member}`);
+    }
+    const profile = merchantProfileRecognizerById(sub.profile);
+    if (!profile)
+        throw new SubstitutionError("the substitution names no merchant profile Agentcard reviewed");
+    if (!sameSteps(sub.path, profile.holder)) {
+        throw new SubstitutionError(`the substitution path is not where ${profile.merchant}'s card request holds the card`);
+    }
+    const fields = isPlainObject(sub.fields) ? Object.fromEntries(Object.entries(sub.fields)) : {};
+    const names = Object.keys(fields);
+    const reviewed = Object.values(profile.fields);
+    if (names.length !== reviewed.length || !reviewed.every((name) => names.includes(name))) {
+        throw new SubstitutionError(`the substitution fields are not ${profile.merchant}'s four encrypted card fields`);
+    }
+    if (!sameSteps(sub.remove, profile.remove)) {
+        throw new SubstitutionError(`the substitution removes other keys than ${profile.merchant}'s reviewed ones`);
+    }
+    const factsRefusal = merchantProfileFactsRefusal(profile);
+    if (factsRefusal)
+        throw new SubstitutionError(`${profile.merchant}'s card facts cannot be written: ${factsRefusal}`);
+    const facts = profile.facts ?? [];
+    const declaresSet = Object.prototype.hasOwnProperty.call(sub, "set");
+    if (facts.length === 0 && declaresSet) {
+        throw new SubstitutionError(`unexpected substitution member set: ${profile.merchant}'s card request takes no card facts`);
+    }
+    const set = facts.length === 0 ? [] : checkedFactSet(sub.set, facts, profile.merchant);
+    const refusal = merchantBodyRefusal(profile.id, body);
+    if (refusal)
+        throw new SubstitutionError(refusal);
+    const out = swapMerchantHostedFields(body, { path: profile.holder, fields, remove: profile.remove, ...set.length ? { set } : {} });
+    if (profile.status !== "enabled" && opts?.sandboxDeclared !== true) {
+        throw new SubstitutionError(`Agentcard has not turned on payments to ${profile.merchant} yet`);
+    }
+    return out;
+}
+export { SubstitutionError, substituteEncryptedFields, substituteMerchantHosted };