@agent-cards/sdk 0.21.0 → 0.23.0

package/dist/adyen-merchant-hosted.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 582753ad6e0ff77d4f5c10416b259928d1e00ea236a2f9d55af5865ef9c08243
+// artifact-sha256: 7e4df686b96640378871d711a94bb545232ca858824a30c20e5a9d242a255f3b
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -48,6 +48,28 @@ function pathsOverlap(a, b) {
             return false;
     return true;
 }
+function sameKeyIgnoringCase(key, step) {
+    return !FORBIDDEN_KEYS.has(key) && (key.toLowerCase() === step.toLowerCase() || key.toUpperCase() === step.toUpperCase());
+}
+function valuesIgnoringCase(root, path) {
+    let nodes = [root];
+    for (const step of path) {
+        const next = [];
+        for (const node of nodes) {
+            if (typeof step === "number") {
+                if (Array.isArray(node) && Number.isSafeInteger(step) && step >= 0 && step < node.length)
+                    next.push(node[step]);
+            }
+            else if (isPlainObject(node)) {
+                for (const key of Object.keys(node))
+                    if (sameKeyIgnoringCase(key, step))
+                        next.push(node[key]);
+            }
+        }
+        nodes = next;
+    }
+    return nodes;
+}
 function describePath(path) {
     return path.length ? path.map((step) => typeof step === "number" ? `[${step}]` : `.${step}`).join("").replace(/^\./, "") : "(root)";
 }
@@ -57,9 +79,14 @@ var PLACEHOLDER_NAME = /^[A-Za-z][A-Za-z0-9_]{0,31}$/;
 var LITERAL_SEGMENT = /^[A-Za-z0-9._~@+-]{1,256}$/;
 var QUERY_KEY = /^[A-Za-z0-9._~-]{1,64}$/;
 var QUERY_LITERAL = /^[A-Za-z0-9._~,-]{0,256}$/;
+var QUERY_PREFIX = /^(?:[A-Za-z0-9._~,-]|%[0-9A-F]{2}){1,64}$/;
 var MAX_QUERIES = 8;
 var MAX_PAIRS = 16;
 var placeholderValue = (value) => PLACEHOLDER_VALUE.test(value) && value !== "." && !value.includes("..");
+function queryPlaceholder(value) {
+    const mark = value.lastIndexOf(":");
+    return mark === -1 ? null : { prefix: value.slice(0, mark), name: value.slice(mark + 1) };
+}
 function pathPlaceholders(template, pathname) {
     if (typeof template !== "string" || typeof pathname !== "string")
         return null;
@@ -104,10 +131,14 @@ function queryPlaceholders(query, text) {
         const written = got[i].slice(mark + 1);
         if (typeof value !== "string")
             return null;
-        if (value.startsWith(":")) {
-            if (!placeholderValue(written))
+        const placeholder = queryPlaceholder(value);
+        if (placeholder) {
+            if (!written.startsWith(placeholder.prefix))
+                return null;
+            const rest = written.slice(placeholder.prefix.length);
+            if (!placeholderValue(rest))
                 return null;
-            values[value.slice(1)] = written;
+            values[placeholder.name] = rest;
         }
         else if (written !== value) {
             return null;
@@ -156,9 +187,11 @@ function templatePlaceholders(template) {
     const queries = Array.isArray(template?.queries) ? template.queries : [template?.query];
     for (const query of queries) {
         if (query && typeof query === "object") {
-            for (const value of Object.values(query))
-                if (typeof value === "string" && value.startsWith(":"))
-                    names.push(value.slice(1));
+            for (const value of Object.values(query)) {
+                const placeholder = typeof value === "string" ? queryPlaceholder(value) : null;
+                if (placeholder)
+                    names.push(placeholder.name);
+            }
         }
     }
     return names;
@@ -193,7 +226,8 @@ function queryTemplateRefusal(query) {
             return `the query key "${key}" is not unreserved characters`;
         if (typeof value !== "string")
             return `the query value of ${key} is not text`;
-        if (value.startsWith(":") ? !PLACEHOLDER_NAME.test(value.slice(1)) : !QUERY_LITERAL.test(value)) {
+        const placeholder = queryPlaceholder(value);
+        if (placeholder ? !PLACEHOLDER_NAME.test(placeholder.name) || placeholder.prefix !== "" && !QUERY_PREFIX.test(placeholder.prefix) : !QUERY_LITERAL.test(value)) {
             return `the query value of ${key} is neither a literal nor a :name placeholder`;
         }
     }
@@ -713,6 +747,55 @@ function adyenAmount(value) {
     const currency = typeof value.currency === "string" && /^[A-Za-z]{3}$/.test(value.currency) ? value.currency.toUpperCase() : null;
     return minor === null || !currency ? null : { minor, currency };
 }
+var BODY_AMOUNT_MEMBERS = ["value", "currency", "format", "unit"];
+function merchantBodyAmountRefusal(profile) {
+    if (!isPlainObject(profile))
+        return "the profile is not an object";
+    const amount = profile.amount;
+    if (amount === null)
+        return null;
+    if (Array.isArray(amount))
+        return pathRefusal(amount, "the body amount");
+    const members = membersRefusal(amount, BODY_AMOUNT_MEMBERS, BODY_AMOUNT_MEMBERS, "the body amount");
+    if (members)
+        return members;
+    const paths = pathRefusal(amount.value, "the body amount's value") ?? pathRefusal(amount.currency, "the body amount's currency");
+    if (paths)
+        return paths;
+    if (pathsOverlap(amount.value, amount.currency))
+        return "the body amount's value and currency are read at the same place";
+    if (!FORMATS.includes(amount.format))
+        return `the body amount's format is not one of ${FORMATS.join(", ")}`;
+    if (!["major", "minor"].includes(amount.unit))
+        return "the body amount's unit is not major or minor";
+    if (amount.format !== "number" && amount.unit !== "major")
+        return "a decimal body amount is in major units";
+    return null;
+}
+function readMerchantBodyAmount(profile, body) {
+    const refusal = merchantBodyAmountRefusal(profile);
+    if (refusal)
+        throw new Error(`Refusing to pay: ${profile?.merchant ?? "this merchant"}'s body amount is not a reviewed declaration: ${refusal}.`);
+    const amount = profile.amount;
+    if (amount === null)
+        return { kind: "unnamed" };
+    if (Array.isArray(amount)) {
+        const at = jsonAt(body, amount);
+        if (!at.found)
+            return { kind: "absent" };
+        const named = adyenAmount(at.value);
+        return named ? { kind: "amount", amountCents: named.minor, currency: named.currency } : { kind: "unreadable" };
+    }
+    const value = jsonAt(body, amount.value);
+    if (!value.found)
+        return { kind: "absent" };
+    const currency = jsonAt(body, amount.currency);
+    if (!currency.found || typeof currency.value !== "string" || !/^[A-Za-z]{3}$/.test(currency.value))
+        return { kind: "unreadable" };
+    const code = currency.value.toUpperCase();
+    const minor = totalMinor(value.value, amount.format, amount.unit, code);
+    return minor === null ? { kind: "unreadable" } : { kind: "amount", amountCents: minor, currency: code };
+}
 function readMerchantAmount(profile, input) {
     const stage = isPlainObject(profile) ? profile.amountSource : void 0;
     if (!isPlainObject(stage))
@@ -776,18 +859,15 @@ function readMerchantAmount(profile, input) {
             return fail("stale", `the card request was built from another ${merchant} response than the latest one (${describePath(rule.card)})`);
         }
     }
-    let bodyAmount = "none";
-    if (Array.isArray(profile.amount)) {
-        const at = jsonAt(ctx.body, profile.amount);
-        bodyAmount = at.found ? "equal" : "absent";
-        if (at.found) {
-            const named = adyenAmount(at.value);
-            if (!named)
-                return fail("unreadable", `the amount in ${merchant}'s card request is not the {value, currency} Agentcard reviewed`);
-            if (named.currency !== reading.currency || named.minor !== reading.amountCents) {
-                return fail("mismatch", `${merchant}'s card request asks for ${named.minor} ${named.currency}, but its own total is ${reading.amountCents} ${reading.currency}`);
-            }
-        }
+    if (merchantBodyAmountRefusal(profile) !== null)
+        return fail("unreviewed", `${merchant}'s body amount is not a reviewed declaration`);
+    const named = readMerchantBodyAmount(profile, ctx.body);
+    const bodyAmount = named.kind === "unnamed" ? "none" : named.kind === "absent" ? "absent" : "equal";
+    if (named.kind === "unreadable") {
+        return fail("unreadable", `the amount in ${merchant}'s card request is not the ${Array.isArray(profile.amount) ? "{value, currency}" : "amount"} Agentcard reviewed`);
+    }
+    if (named.kind === "amount" && (named.currency !== reading.currency || named.amountCents !== reading.amountCents)) {
+        return fail("mismatch", `${merchant}'s card request asks for ${named.amountCents} ${named.currency}, but its own total is ${reading.amountCents} ${reading.currency}`);
     }
     return {
         ok: true,
@@ -1307,6 +1387,154 @@ var MERCHANT_HOSTED_PROFILES = /* @__PURE__ */ deepFreeze([
             clientKey: "live_YJLFKT47JJG2RI7QIYX6HTKKDEDOEGOH",
             publicKeySha256: "da33611149dff3ab715be8671c0550bb8aec6112983b2473db9ee7afb829c110"
         }
+    },
+    {
+        // Read Sep 25, 2026, from public code only: the WooCommerce plugin super-payments 1.40.1 and
+        // cdn.superpayments.com/js/v2/payment.webcomponents.script.js as it stood on Sep 19.
+        // WePrescribe's page runs Super's <super-checkout> component, which picks the card leg per
+        // checkout session: ADYEN, under Super's own Adyen account (adyen-web 6.36.0 in Super's frame
+        // web-checkout.superpayments.com/adyen-card-host, which hands state.data to the page by
+        // postMessage), or STRIPE, a Payment Element the stripe definition already pays. On the ADYEN
+        // leg handleAdyenSubmit posts, with the session's Bearer token, {amount (the gross, minor
+        // units), currency, fundingMethod: {amount (the card's net share), type CARD, providerArgs:
+        // {type ADYEN, paymentMethod: {type CARD, the four JWEs, holderName, postalCode},
+        // browserInfo}}, rewardsToUse} from the page to api.superpayments.com. The card is charged
+        // fundingMethod.amount, so that is what the agent's amount must equal. No brand rides in the
+        // body. A saved card sends type SAVED_CARD with storedPaymentMethodId and no JWEs. Super's
+        // save-card component posts ciphertext to client.superpayments.com/setup-intent/confirm,
+        // which the WooCommerce checkout never calls. Public key read from checkoutshopper-live.adyen.com
+        // on 2026-09-25 and again on 2026-09-30 (UTC), unchanged. The path carries the checkout
+        // session id, which no preparation can name before the card request exists, so the review
+        // rules hold this profile in observe. A HAR still has to confirm the leg Super picks for a
+        // WePrescribe order and the body that leg posts.
+        id: "super_payments_checkout",
+        merchant: "Super Payments",
+        status: "observe",
+        origins: [{ checkout: "https://weprescribe.co.uk", endpoint: "https://api.superpayments.com" }],
+        method: "POST",
+        path: "/v3/checkout-sessions/:checkoutSessionId/payment",
+        query: {},
+        requires: [
+            { path: ["fundingMethod", "type"], equals: "CARD" },
+            { path: ["fundingMethod", "providerArgs", "type"], equals: "ADYEN" }
+        ],
+        holder: ["fundingMethod", "providerArgs", "paymentMethod"],
+        holderType: "CARD",
+        fields: {
+            encryptedCardNumber: "encryptedCardNumber",
+            encryptedExpiryMonth: "encryptedExpiryMonth",
+            encryptedExpiryYear: "encryptedExpiryYear",
+            encryptedSecurityCode: "encryptedSecurityCode"
+        },
+        remove: [],
+        refuse: [
+            { path: ["fundingMethod", "providerArgs", "paymentMethod", "storedPaymentMethodId"], when: "present" }
+        ],
+        amount: { value: ["fundingMethod", "amount"], currency: ["currency"], format: "number", unit: "minor" },
+        otherCardRequests: [{ origin: "https://client.superpayments.com", path: "/setup-intent/confirm" }],
+        adyen: {
+            environment: "live",
+            clientKey: "live_5MO5NXLPV5HPFJZWKYBAGA5RRMHEYWSD",
+            publicKeySha256: "b1cd67db43491625b433c9b864beea8a0f0351378bcd3e9e1e0f19e3aad38fcf"
+        }
+    },
+    {
+        // Read Sep 25, 2026, from public code only.
+        // www.corepoweryoga.com asks its API for a hosted payment page (the card-free POST
+        // api2.corepoweryoga.com/stored-payment answers hosted_payment_uri) and frames it: Zenoti
+        // Payments, Zenoti's Adyen platform, at corepoweryoga.zenoti.com/OnlinePayments/AdyentHPP.aspx,
+        // a cross-origin frame running adyen-web v6 Drop-in in the Advanced flow. Its makePayment
+        // (fintech-cdn.zenoti.com .../AdyentHPP.js, SHA-256 95e14da8...5df39) posts {processorId,
+        // subscriberId, transactionSource, paymentRequest: {paymentMethod: adyen-web's
+        // state.data.paymentMethod, type: that method's type, reference, BrowserInformation,
+        // shopperLocale, signature, channel, amount: {currency, value}, brand: onBrand's code for the
+        // typed card, FirstRecurringCharge}} to AdyentHPP.aspx/ProcessTransaction on the frame's own
+        // origin, and Zenoti's server calls Adyen /payments. The pair names the top page, the checkout
+        // the SDK prepares on. paymentRequest.brand describes the agent's dummy, so the approved card's
+        // brand is written there, beside the holder, and adyen-web's own brand at the holder is dropped.
+        // This request saves the card on file: CorePower then charges the stored card on its server
+        // (api2.corepoweryoga.com/purchase-invoice-cc-on-file) and memberships bill it monthly. The
+        // client key and environment arrive with the frame's per-session token, which only a signed-in
+        // shopper's page reads, so the key is a draft until a HAR pins it.
+        id: "zenoti_corepoweryoga_hpp",
+        merchant: "CorePower Yoga",
+        status: "observe",
+        origins: [{ checkout: "https://www.corepoweryoga.com", endpoint: "https://corepoweryoga.zenoti.com" }],
+        method: "POST",
+        path: "/OnlinePayments/AdyentHPP.aspx/ProcessTransaction",
+        query: {},
+        requires: [{ path: ["paymentRequest", "type"], equals: "scheme" }],
+        holder: ["paymentRequest", "paymentMethod"],
+        fields: {
+            encryptedCardNumber: "encryptedCardNumber",
+            encryptedExpiryMonth: "encryptedExpiryMonth",
+            encryptedExpiryYear: "encryptedExpiryYear",
+            encryptedSecurityCode: "encryptedSecurityCode"
+        },
+        remove: ["brand"],
+        refuse: [
+            { path: ["paymentRequest", "storePaymentMethod"], when: "true" },
+            { path: ["paymentRequest", "paymentMethod", "storedPaymentMethodId"], when: "present" },
+            { path: ["paymentRequest", "paymentMethod", "recurringDetailReference"], when: "present" }
+        ],
+        amount: ["paymentRequest", "amount"],
+        facts: [
+            // adyen-web's brand codes, as onBrand reports them.
+            {
+                path: ["paymentRequest", "brand"],
+                fact: "brand",
+                map: { visa: "visa", mastercard: "mc", amex: "amex", discover: "discover", diners: "diners", jcb: "jcb" }
+            }
+        ],
+        adyen: { environment: "live", clientKey: null, publicKeySha256: null }
+    },
+    {
+        // Read Sep 25, 2026, from public code only: the Cathay Payment Page bundle on
+        // payment.cathaypacific.com (main.14d368386ca2a9041a823b758307b3c2.js, adyen-web 5.71.5
+        // securedfields, environment live), where flight bookings and manage-booking pay. The page
+        // builds one outgoing request: amount and currency from the booking (a decimal
+        // number in major units; the cash part when miles pay the rest), the four JWEs at its root as
+        // encrypted_card_number, encrypted_expiry_month, encrypted_expiry_year and
+        // encrypted_security_code, raw_card_bin (the typed card's BIN, as adyen-web's issuerBin or
+        // binValue reports it), store_a_card, pay_with_stored_card, stored_card_token and
+        // pay_with_adyen_web true. signAndAuthorise posts {sign_request: that request, hpp_signature}
+        // to /cpp-paypage/v1/public/sign (header signapi: authorise, or its discount, currency, split,
+        // full-miles or bank-form variant), then a copy made before signing, plus the returned
+        // cpp_signature, to /cpp-paypage/v1/miles-plus-cash-authorise, which charges it. The signature
+        // covers the JWEs, so the card request is the signing step and the charge is its then request.
+        // raw_card_bin describes the dummy, so the approved card's BIN6 is written there, never more
+        // (adyen-web can report eight digits). The client key comes from document.cppData per
+        // session, so the key is a draft until a HAR pins it. The page's other card form sends a card
+        // alias (alias_card_number) in place of the JWEs, and a refuse rule below turns it away.
+        id: "cathay_cpp_sign",
+        merchant: "Cathay Pacific",
+        status: "observe",
+        origins: [{ checkout: "https://payment.cathaypacific.com", endpoint: "https://api.cathaypacific.com" }],
+        method: "POST",
+        path: "/cpp-paypage/v1/public/sign",
+        query: {},
+        requires: [
+            { path: ["sign_request", "pay_with_adyen_web"], equals: true },
+            { path: ["sign_request", "pay_with_stored_card"], equals: false },
+            { path: ["sign_request", "stored_card_token"], equals: "" }
+        ],
+        holder: ["sign_request"],
+        fields: {
+            encryptedCardNumber: "encrypted_card_number",
+            encryptedExpiryMonth: "encrypted_expiry_month",
+            encryptedExpiryYear: "encrypted_expiry_year",
+            encryptedSecurityCode: "encrypted_security_code"
+        },
+        remove: [],
+        refuse: [
+            { path: ["sign_request", "store_a_card"], when: "true" },
+            { path: ["sign_request", "stored_card_id"], when: "present" },
+            { path: ["sign_request", "alias_card_number"], when: "present" }
+        ],
+        amount: { value: ["sign_request", "amount"], currency: ["sign_request", "currency"], format: "number", unit: "major" },
+        facts: [{ path: ["sign_request", "raw_card_bin"], fact: "bin6" }],
+        then: { method: "POST", path: "/cpp-paypage/v1/miles-plus-cash-authorise", query: {}, holder: [] },
+        adyen: { environment: "live", clientKey: null, publicKeySha256: null }
     }
 ]);
 function adyenKeyHost(environment) {
@@ -1352,9 +1580,11 @@ var IPV4_HOST = /^\d{1,3}(?:\.\d{1,3}){3}$/;
 function underDomain(hostname, domain) {
     return hostname === domain || hostname.endsWith(`.${domain}`);
 }
+var TWO_LABEL_SUFFIXES = /* @__PURE__ */ new Set(["co.uk", "org.uk", "ac.uk", "com.au", "net.au", "co.nz", "co.jp", "com.hk", "com.sg", "co.in"]);
 function reviewedDomain(hostname) {
     const labels = hostname.split(".");
-    return labels.length > 2 ? labels.slice(1).join(".") : hostname;
+    const kept = TWO_LABEL_SUFFIXES.has(labels.slice(-2).join(".")) ? 3 : 2;
+    return labels.length > kept ? labels.slice(1).join(".") : hostname;
 }
 function declaredEndpointRefusal(endpoint) {
     let url;
@@ -1380,28 +1610,6 @@ function declaredEndpointRefusal(endpoint) {
         return `${url.hostname} belongs to a merchant Agentcard reviewed, so it cannot be declared`;
     return null;
 }
-function sameKeyIgnoringCase(key, step) {
-    return !FORBIDDEN_KEYS.has(key) && (key.toLowerCase() === step.toLowerCase() || key.toUpperCase() === step.toUpperCase());
-}
-function valuesIgnoringCase(root, path) {
-    let nodes = [root];
-    for (const step of path) {
-        const next = [];
-        for (const node of nodes) {
-            if (typeof step === "number") {
-                if (Array.isArray(node) && Number.isSafeInteger(step) && step >= 0 && step < node.length)
-                    next.push(node[step]);
-            }
-            else if (isPlainObject(node)) {
-                for (const key of Object.keys(node))
-                    if (sameKeyIgnoringCase(key, step))
-                        next.push(node[key]);
-            }
-        }
-        nodes = next;
-    }
-    return nodes;
-}
 function merchantBodyRefusal(profile, body) {
     const p = merchantProfileRecognizerById(typeof profile === "string" ? profile : profile?.id);
     if (!p)
@@ -1639,6 +1847,10 @@ function reviewedProfile(profileId) {
         throw new Error("Refusing to pay: unknown merchant profile.");
     return profile;
 }
+function otherCardRequestOf(profile, url) {
+    const others = Array.isArray(profile.otherCardRequests) ? profile.otherCardRequests : [];
+    return others.find((other) => other.origin === url.origin && pathMatchesTemplate(other.path, url.pathname));
+}
 function merchantProfileUrlRelation(profileId, rawUrl) {
     const profile = reviewedProfile(profileId);
     if (typeof rawUrl !== "string")
@@ -1654,9 +1866,12 @@ function merchantProfileUrlRelation(profileId, rawUrl) {
     }
     if (url.protocol !== "https:" || url.port || url.username || url.password)
         return null;
-    if (!profile.origins.some((pair) => pair.endpoint === url.origin))
-        return null;
-    return pathMatchesTemplate(profile.path, url.pathname) ? "sibling" : null;
+    const onEndpoint = profile.origins.some((pair) => pair.endpoint === url.origin);
+    if (onEndpoint && pathMatchesTemplate(profile.path, url.pathname))
+        return "sibling";
+    if (onEndpoint && isPlainObject(profile.then) && pathMatchesTemplate(profile.then.path, url.pathname))
+        return "then";
+    return otherCardRequestOf(profile, url) ? "other" : null;
 }
 var JWE_AT = /ey[A-Za-z0-9_-]{1,126}\.[A-Za-z0-9_-]{342}\.[A-Za-z0-9_-]{16}\.[A-Za-z0-9_-]{1,1024}\.[A-Za-z0-9_-]{22}/y;
 var LEGACY_BLOB = /adyenjs_0_1_\d{1,4}(?:\$|%24)/i;
@@ -1738,15 +1953,30 @@ function holderRefusal(profile, parsed) {
     if (new Set(values).size !== values.length)
         return "two encrypted card fields in the paused body are the same";
     const type = holder.value.type;
-    if (type !== void 0 && type !== "scheme")
+    if (type !== void 0 && type !== (profile.holderType ?? "scheme"))
         return "the paused body pays with something other than a card";
     return null;
 }
 function amountRefusal(profile, parsed) {
     const priced = isPlainObject(profile.amountSource);
-    if (!Array.isArray(profile.amount)) {
+    if (profile.amount === null || profile.amount === void 0) {
         return priced ? null : `${profile.merchant}'s card request names no amount, so it cannot be checked against the amount the cardholder approves`;
     }
+    if (!Array.isArray(profile.amount)) {
+        let read;
+        try {
+            read = readMerchantBodyAmount(profile, parsed);
+        }
+        catch {
+            read = { kind: "unreadable" };
+        }
+        if (read.kind === "amount")
+            return null;
+        if (read.kind === "absent") {
+            return priced ? null : `the paused body names no amount where ${profile.merchant}'s card request holds it, so it cannot be checked against the amount the cardholder approves`;
+        }
+        return `the amount where ${profile.merchant}'s card request holds it is not the amount Agentcard reviewed, so it cannot be checked`;
+    }
     const at = jsonAt(parsed, profile.amount);
     if (!at.found) {
         return priced ? null : `the paused body names no amount where ${profile.merchant}'s card request holds it, so it cannot be checked against the amount the cardholder approves`;
@@ -1774,9 +2004,12 @@ function classifyMerchantRequest(profileId, rawUrl, method, body) {
     const relation = merchantProfileUrlRelation(profile.id, rawUrl);
     if (!relation || !carriesAdyenCardCiphertext(body))
         return PASS;
-    if (relation === "sibling") {
+    if (relation === "sibling" || relation === "other") {
         return abort(`the paused request sends a card to ${profile.merchant} somewhere other than the card request Agentcard reviewed`);
     }
+    if (relation === "then") {
+        return abort(`the paused request sends ${profile.merchant}'s card again, to the request after the card request Agentcard reviewed, and Agentcard does not write the card there yet`);
+    }
     if (typeof method !== "string" || method.toUpperCase() !== profile.method) {
         return abort(`the paused request sends a card to ${profile.merchant} as ${String(method).toUpperCase()}, not as the ${profile.method} Agentcard reviewed`);
     }
@@ -1816,16 +2049,23 @@ function declaredTemplatedUrl(endpoint) {
 }
 function merchantProfileTemplatedUrl(profileId, rawUrl) {
     const profile = reviewedProfile(profileId);
-    let origin = null;
+    let url = null;
     try {
-        origin = new URL(rawUrl).origin;
+        url = new URL(rawUrl);
     }
     catch {
-        origin = null;
+        url = null;
+    }
+    const origin = url ? url.origin : null;
+    const relation = url ? merchantProfileUrlRelation(profile.id, rawUrl) : null;
+    if (relation === "other") {
+        const other = otherCardRequestOf(profile, url);
+        return `${other.origin}${other.path}`;
     }
     const pair = profile.origins.find((candidate) => candidate.endpoint === origin) ?? profile.origins[0];
-    const query = Object.entries(profile.query).map(([key, value]) => `${key}=${value}`).join("&");
-    return `${pair.endpoint}${profile.path}${query ? `?${query}` : ""}`;
+    const request = relation === "then" ? profile.then : profile;
+    const query = Object.entries(request.query).map(([key, value]) => `${key}=${value}`).join("&");
+    return `${pair.endpoint}${request.path}${query ? `?${query}` : ""}`;
 }
 function keyPaths(root, out) {
     const stack = [[root, ""]];
@@ -1858,10 +2098,16 @@ function merchantBodyKeyPathSha256(body) {
     return sha256Hex([...paths].sort().join("\n"));
 }
 var globEscape = (text) => text.replace(/[*?\\]/g, (char) => `\\${char}`);
+var templateGlob = (template) => template.split("/").map((segment) => segment.startsWith(":") ? "*" : globEscape(segment)).join("/");
 function merchantProfileUrlGlobs(profileId) {
     const profile = reviewedProfile(profileId);
-    const path = profile.path.split("/").map((segment) => segment.startsWith(":") ? "*" : globEscape(segment)).join("/");
-    return [...new Set(profile.origins.map((pair) => `${pair.endpoint}${path}*`))];
+    const endpoints = profile.origins.map((pair) => pair.endpoint);
+    const others = Array.isArray(profile.otherCardRequests) ? profile.otherCardRequests : [];
+    return [... /* @__PURE__ */new Set([
+            ...endpoints.map((origin) => `${origin}${templateGlob(profile.path)}*`),
+            ...isPlainObject(profile.then) ? endpoints.map((origin) => `${origin}${templateGlob(profile.then.path)}*`) : [],
+            ...others.map((other) => `${other.origin}${templateGlob(other.path)}*`)
+        ])];
 }
 function declaredUrlGlobs(endpoint) {
     const url = new URL(endpoint);

package/dist/agentcard.d.ts

@@ -46,14 +46,21 @@ export declare class CheckoutModule {
         headers: Record<string, string>;
         body: string;
     }): ReturnType<VaultClient['checkStripeContinuation']>;
+    /** Asks the API whether a Stripe card save may continue with the payment method an approval produced. */
+    checkStripeSetupContinuation(authorizationId: string, request: {
+        url: string;
+        method: string;
+        headers: Record<string, string>;
+        body: string;
+    }): ReturnType<VaultClient['checkStripeSetupContinuation']>;
     /** True when this request is a card request a recogniser claims. */
     isCardRequest(url: string, method?: string): boolean;
     /** The recogniser that claims a card request, or null. */
     recognizerOf(url: string, method?: string): Recognizer | null;
     /** How the card would reach the processor on this request, or null when nothing recognises it. */
     checkoutModeOf(url: string, method?: string): CheckoutMode | null;
-    /** What happens to a recognised request whose body carries no card. */
-    withoutCard(url: string, body: string | null | undefined): 'continue' | 'refuse' | null;
+    /** What happens to a recognised request whose body carries no card, given the requests this attachment already handed the card to. */
+    withoutCard(url: string, body: string | null | undefined, handedTo?: readonly string[]): 'continue' | 'refuse' | null;
     /** The URL patterns a raw CDP connection hands `Fetch.enable`, for the current recognisers. */
     cardUrlPatterns(): string[];
     /** The recognisers: the served or built-in list plus yours (`register`, `list`, `find`). */

package/dist/agentcard.js

@@ -42,14 +42,16 @@ export class CheckoutModule {
     cancelAuthorization(authorizationId, reason) { return this.client.cancelAuthorization(authorizationId, reason); }
     /** Asks the API whether a Stripe confirmation that pays with an approved token may continue. */
     checkStripeContinuation(authorizationId, request) { return this.client.checkStripeContinuation(authorizationId, request); }
+    /** Asks the API whether a Stripe card save may continue with the payment method an approval produced. */
+    checkStripeSetupContinuation(authorizationId, request) { return this.client.checkStripeSetupContinuation(authorizationId, request); }
     /** True when this request is a card request a recogniser claims. */
     isCardRequest(url, method = 'POST') { return this.client.isCardRequest(url, method); }
     /** The recogniser that claims a card request, or null. */
     recognizerOf(url, method = 'POST') { return this.client.recognizerOf(url, method); }
     /** How the card would reach the processor on this request, or null when nothing recognises it. */
     checkoutModeOf(url, method = 'POST') { return this.client.checkoutModeOf(url, method); }
-    /** What happens to a recognised request whose body carries no card. */
-    withoutCard(url, body) { return this.client.withoutCard(url, body); }
+    /** What happens to a recognised request whose body carries no card, given the requests this attachment already handed the card to. */
+    withoutCard(url, body, handedTo = []) { return this.client.withoutCard(url, body, handedTo); }
     /** The URL patterns a raw CDP connection hands `Fetch.enable`, for the current recognisers. */
     cardUrlPatterns() { return this.client.cardUrlPatterns(); }
     /** The recognisers: the served or built-in list plus yours (`register`, `list`, `find`). */

package/dist/amadeus-checkout.generated.d.ts

@@ -0,0 +1,57 @@
+declare var AMADEUS_CARD_MOPID: RegExp;
+declare function amadeusBodyKind(body: any): "card" | "other";
+declare var AMADEUS_CHECKOUT_PSP: string;
+declare var AMADEUS_CHECKOUT_CAPABILITY: string;
+declare var AMADEUS_CARD_URLS: Readonly<{
+    production: Readonly<{
+        sdk: readonly string[];
+        dcp: readonly string[];
+    }>;
+    sandbox: Readonly<{
+        sdk: readonly string[];
+        dcp: readonly never[];
+    }>;
+}>;
+declare var AMADEUS_MERCHANT_EXPIRY_POLICIES: readonly string[];
+declare var AMADEUS_MERCHANT_EXPIRY_POLICY: string;
+declare var AMADEUS_REFUSAL_REASONS: readonly string[];
+declare function readAmadeusBody(body: any): any;
+declare function amadeusCardUrl(url: any): {
+    path: string;
+    environment: string;
+} | null;
+declare function isAmadeusCardUrl(url: any, method?: string): boolean;
+declare function amadeusEnvironment(url: any): string | undefined;
+declare function amadeusPreparationUrls(environment: any): any[];
+declare function amadeusSdkHostRefusal(headers: any, approvedHost: any): "header_binding" | null;
+declare var AMADEUS_DCP_REVIEWED_KEYS: readonly string[];
+declare function isAmadeusDcpConfig(config: any): boolean;
+declare function amadeusVendorFor(number: any): "visa" | "mastercard" | "amex" | null;
+declare function amadeusRequestRefusal(request: any, card: any, options?: {}): any;
+declare function amadeusRefusalMessage(reason: any): any;
+declare function isPreparedAmadeusRequest(url: any, method: any, body: any, environment: any, headers: any, options?: {}): boolean;
+declare function injectAmadeusCard(body: any, card: any, options?: {}): {
+    body: string;
+    where: any[];
+};
+declare function amadeusResponseOutcome(status: any, body: any, { url, card }?: {}): {
+    outcome: string;
+    reason: string;
+    feeApplied?: undefined;
+    code?: undefined;
+} | {
+    outcome: string;
+    feeApplied: boolean;
+    reason?: undefined;
+    code?: undefined;
+} | {
+    outcome: string;
+    code: any;
+    reason?: undefined;
+    feeApplied?: undefined;
+};
+declare function sanitizeAmadeusResponse(body: any, url: any, card: any): string;
+declare function amadeusFacts(body: any): {
+    refusalCode: any;
+};
+export { AMADEUS_CARD_MOPID, AMADEUS_CARD_URLS, AMADEUS_CHECKOUT_CAPABILITY, AMADEUS_CHECKOUT_PSP, AMADEUS_DCP_REVIEWED_KEYS, AMADEUS_MERCHANT_EXPIRY_POLICIES, AMADEUS_MERCHANT_EXPIRY_POLICY, AMADEUS_REFUSAL_REASONS, amadeusBodyKind, amadeusCardUrl, amadeusEnvironment, amadeusFacts, amadeusPreparationUrls, amadeusRefusalMessage, amadeusRequestRefusal, amadeusResponseOutcome, amadeusSdkHostRefusal, amadeusVendorFor, injectAmadeusCard, isAmadeusCardUrl, isAmadeusDcpConfig, isPreparedAmadeusRequest, readAmadeusBody, sanitizeAmadeusResponse };