@agent-cards/sdk 0.22.0 → 0.23.0

package/dist/merchant-card-endpoints.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 0149082f3796b4b5bbe843a6ab8e4f34f551de49e3edfc69ccf66d3cba1ba272
+// artifact-sha256: 82c93c756fd934cb52d2d868b73e546d741aebbe53f12d4c38c9173abf7a0c03
 // src/json-path.js
 var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function isPlainObject(v) {
@@ -56,6 +56,10 @@ function describePath(path) {
 // src/url-template.js
 var PLACEHOLDER_VALUE = /^[A-Za-z0-9._~@+-]{1,256}$/;
 var placeholderValue = (value) => PLACEHOLDER_VALUE.test(value) && value !== "." && !value.includes("..");
+function queryPlaceholder(value) {
+    const mark = value.lastIndexOf(":");
+    return mark === -1 ? null : { prefix: value.slice(0, mark), name: value.slice(mark + 1) };
+}
 function pathPlaceholders(template, pathname) {
     if (typeof template !== "string" || typeof pathname !== "string")
         return null;
@@ -100,10 +104,14 @@ function queryPlaceholders(query, text) {
         const written = got[i].slice(mark + 1);
         if (typeof value !== "string")
             return null;
-        if (value.startsWith(":")) {
-            if (!placeholderValue(written))
+        const placeholder = queryPlaceholder(value);
+        if (placeholder) {
+            if (!written.startsWith(placeholder.prefix))
+                return null;
+            const rest = written.slice(placeholder.prefix.length);
+            if (!placeholderValue(rest))
                 return null;
-            values[value.slice(1)] = written;
+            values[placeholder.name] = rest;
         }
         else if (written !== value) {
             return null;
@@ -111,6 +119,37 @@ function queryPlaceholders(query, text) {
     }
     return values;
 }
+function strictUrl(rawUrl) {
+    if (typeof rawUrl !== "string" || rawUrl.includes("#"))
+        return null;
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        return null;
+    }
+    if (url.href !== rawUrl || url.protocol !== "https:" || url.port || url.username || url.password)
+        return null;
+    return url;
+}
+function urlTemplateMatch(template, rawUrl) {
+    const url = strictUrl(rawUrl);
+    if (!url || !template || typeof template !== "object")
+        return null;
+    const fromPath = pathPlaceholders(template.path, url.pathname);
+    if (!fromPath)
+        return null;
+    const mark = rawUrl.indexOf("?");
+    const text = mark === -1 ? null : rawUrl.slice(mark + 1);
+    const queries = Array.isArray(template.queries) ? template.queries : [template.query];
+    for (const query of queries) {
+        const fromQuery = queryPlaceholders(query, text);
+        if (fromQuery)
+            return { origin: url.origin, placeholders: { ...fromPath, ...fromQuery } };
+    }
+    return null;
+}
 // src/substitution-primitives.js
 var SubstitutionError = class extends Error {
     constructor(message) {
@@ -127,10 +166,485 @@ function deepFreeze(value) {
     }
     return value;
 }
+// src/merchant-card-endpoint-documents.js
+var HILTON_CREATE_RESERVATION_DOCUMENTS = /* @__PURE__ */ Object.freeze([
+    `mutation createReservation($language: String!, $input: ReservationInput!, $mfaInput: ReservationMFAInput, $scaInput: SCAInput, $enrollment: ReservationEnrollInput, $guestLocationCountry: String, $guestUpdate: ReservationGuestUpdateInput, $includePreArrivalOffers: Boolean! = false) {
+  createReservation(
+    language: $language
+    input: $input
+    mfaInput: $mfaInput
+    scaInput: $scaInput
+    enroll: $enrollment
+    guestUpdate: $guestUpdate
+  ) {
+    data {
+      digitalPayment {
+        action {
+          paymentData {
+            md
+            paReq
+          }
+          redirectMethod
+          redirectUrl
+        }
+      }
+      enroll {
+        hhonorsNumber
+        resourceAlreadyExists
+      }
+      mfa {
+        transactionState
+      }
+      sca {
+        ...RESERVATION_SCA_FRAGMENT
+      }
+      reservation {
+        ...RESERVATION_FRAGMENT
+      }
+      guestUpdate {
+        preferredAddress {
+          statusCode
+          message
+        }
+        updatePaymentMethod {
+          statusCode
+          message
+        }
+      }
+    }
+    error {
+      code
+      message
+      context
+      notifications {
+        code
+        fields
+        message
+      }
+    }
+  }
+}
+        fragment RESERVATION_SCA_FRAGMENT on SCA {
+  scaId
+  md
+  paReq
+  url
+  termUrl
+}
+fragment RESERVATION_FRAGMENT on Reservation {
+  additionalContext {
+    bookedFor
+    profile
+    program
+    userPermission
+    userRole
+  }
+  addOnsResModifyEligible
+  adjoiningRoomStay
+  adjoiningRoomsFailure
+  arrivalDate
+  autoUpgradedStay
+  cancelEligible
+  certificates {
+    totalPoints
+    totalPointsFmt
+  }
+  clientAccounts {
+    clientId
+    clientType
+    clientName
+    programAccountId
+  }
+  comments {
+    generalInfo
+  }
+  confNumber
+  cost {
+    currency {
+      currencyCode
+      currencySymbol
+      description
+    }
+    roomRevUSD: totalAmountBeforeTax(currencyCode: "USD")
+    totalAddOnsAmount
+    totalAddOnsAmountFmt
+    totalAddOnsAmountUSD: totalAddOnsAmount(currencyCode: "USD")
+    totalAmountBeforeTax
+    totalAmountAfterTaxFmt: guestTotalCostAfterTaxFmt
+    totalAmountAfterTax: guestTotalCostAfterTax
+    totalAmountBeforeTaxFmt
+    totalServiceCharges
+    totalServiceChargesFmt
+    totalServiceChargesUSD: totalServiceCharges(currencyCode: "USD")
+    totalTaxes
+    totalTaxesFmt
+    totalTaxesUSD: totalTaxes(currencyCode: "USD")
+  }
+  cxlNumber
+  departureDate
+  disclaimer {
+    confirmableUpgradeReward
+    confirmableUpgradeReward_noTx: confirmableUpgradeReward
+    diamond48
+    diamond48_noTx: diamond48
+    fullPrePayNonRefundable
+    fullPrePayNonRefundable_noTx: fullPrePayNonRefundable
+    hgfConfirmation
+    hgfConfirmation_noTx: hgfConfirmation
+    hgvMaxTermsAndConditions
+    hgvMaxTermsAndConditions_noTx: hgvMaxTermsAndConditions
+    hhonorsCancellationCharges
+    hhonorsCancellationCharges_noTx: hhonorsCancellationCharges
+    hhonorsPointsDeduction
+    hhonorsPointsDeduction_noTx: hhonorsPointsDeduction
+    hhonorsPrintedConfirmation
+    hhonorsPrintedConfirmation_noTx: hhonorsPrintedConfirmation
+    lengthOfStay
+    lengthOfStay_noTx: lengthOfStay
+    rightToCancel
+    rightToCancel_noTx: rightToCancel
+    totalRate
+    totalRate_noTx: totalRate
+    teamMemberEligibility
+    teamMemberEligibility_noTx: teamMemberEligibility
+    vatCharge
+    vatCharge_noTx: vatCharge
+    cancellationRefundPolicy
+    cancellationRefundPolicy_noTx: cancellationRefundPolicy
+  }
+  guarantee {
+    depositRequired
+    nonRefundable
+    cxlPolicyCode
+    cxlPolicyDesc
+    cxlPolicyDesc_noTx: cxlPolicyDesc
+    guarPolicyCode
+    guarPolicyDesc
+    guarMethodCode
+    taxDisclaimers {
+      text
+      title
+    }
+    disclaimer {
+      legal
+      legal_noTx: legal
+    }
+    paymentCard {
+      cardCode
+      cardName
+      cardNumberMasked(format: masked)
+      cardExpireDate
+      cardPaymentType
+      expireDate: cardExpireDateFmt(format: "MMM yyyy")
+      expireDateFull: cardExpireDateFmt(format: "MMMM yyyy")
+      expired
+    }
+    deposit {
+      amount
+    }
+    taxDisclaimers {
+      text
+      title
+    }
+  }
+  guest {
+    guestId
+    tier
+    name {
+      firstName
+      lastName
+      nameFmt
+    }
+    emails {
+      emailAddressMasked
+      emailType
+      emailAddressHashed
+    }
+    addresses {
+      addressLine1
+      addressLine2
+      city
+      country
+      state
+      postalCode
+      addressFmt
+      addressType
+    }
+    hhonorsNumber
+    phones {
+      phoneNumberMasked(format: masked)
+      phoneType
+    }
+  }
+  guestBenefits {
+    foodAndBeverageCreditBenefit {
+      description
+      heading
+      linkLabel
+      linkUrl
+    }
+  }
+  lastUpdatedBooker {
+    guestId
+    programAccountId
+  }
+  modifyEligible
+  nor1Upgrade(provider: "DOHWR") {
+    content {
+      button
+      description
+      firstName
+      title
+    }
+    offerLink
+    requested
+    success
+  }
+  notifications {
+    subType
+    text
+    type
+  }
+  originalBooker {
+    guestId
+    programAccountId
+  }
+  propCode
+  requests {
+    specialRequests {
+      pets
+      servicePets
+    }
+  }
+  restricted
+  rooms {
+    gnrNumber
+    resCreateDateFmt(format: "yyyy-MM-dd")
+    addOns {
+      addOnCost {
+        amountAfterTax
+        amountAfterTaxFmt
+      }
+      addOnDetails {
+        addOnAvailType
+        addOnDescription
+        addOnCode
+        addOnName
+        addOnPricing
+        addOnUnit
+        addOnUnitCategory
+        amountAfterTax
+        amountAfterTaxFmt
+        averageDailyRate
+        averageDailyRateFmt
+        categoryCode
+        counts {
+          numAddOns
+          fulfillmentDate
+          rate
+          rateFmt
+        }
+        numAddOnDays
+      }
+    }
+    additionalNames {
+      firstName
+      lastName
+    }
+    certificates {
+      certType
+      certNumber
+      totalPoints
+      totalPointsFmt
+    }
+    offers {
+      offerSource
+      originalRoomTypeName
+    }
+    preArrivalOffers(guestLocationCountry: $guestLocationCountry) @include(if: $includePreArrivalOffers) {
+      offeredRoomTypes(
+        filter: {isUpsell: true}
+        sort: [{by: displayCost, order: asc}]
+      ) {
+        adaAccessibleRoom
+        cmaTotalPriceIndicator
+        displayCostFmtRnd: displayCostFmt(decimal: 0, strategy: ceiling)
+        displayCostHotelCurrency: displayCost
+        displayCostUsd: displayCost(currencyCode: "USD")
+        feeTransparencyIndicator
+        images(ratios: [threeByTwo], first: 1) {
+          altText
+          ratios {
+            url
+          }
+        }
+        offerDescription
+        roomRate {
+          amountAfterTax
+          amountAfterTaxFmt(decimal: 0, strategy: ceiling)
+          amountBeforeTaxFmt
+          averageRateFmt
+          fullAmountAfterTax: amountAfterTaxFmt
+          rateAmount
+          rateAmountFmt
+          rateChangeIndicator
+          rateDetails {
+            effectiveDateFmt(format: "medium")
+            effectiveDateFmtAda: effectiveDateFmt(format: "long")
+            rateAmount
+            rateAmountFmt
+          }
+        }
+        roomTypeCode
+        roomTypeName
+      }
+      offerId
+      offerType
+      originalRatePlanCode
+      originalRoomTypeCode
+      validUntil
+    }
+    numAdults
+    numChildren
+    childAges
+    autoUpgradedStay
+    isStaySmu
+    isStayUpsell
+    isStayUpsellOverAutoUpgrade
+    priorRoomType {
+      roomTypeName
+    }
+    cost {
+      currency {
+        currencyCode
+        currencySymbol
+        description
+      }
+      amountAfterTax: guestTotalCostAfterTax
+      amountAfterTaxFmt: guestTotalCostAfterTaxFmt
+      amountBeforeTax
+      amountBeforeTaxFmt
+      serviceChargeDetails
+      serviceChargeFeeType
+      serviceChargePeriods {
+        serviceCharges {
+          amount
+          amountFmt
+          description
+        }
+      }
+      rateAmountFmt
+      rateChanges
+      totalServiceCharges
+      totalServiceChargesFmt
+      totalTaxes
+      totalTaxesFmt
+      rateDetails(perNight: true) {
+        effectiveDateFmt(format: "medium")
+        effectiveDateFmtAda: effectiveDateFmt(format: "long")
+        rateAmount
+        rateAmountFmt
+      }
+      upgradedAmount
+      upgradedAmountFmt
+    }
+    guarantee {
+      cxlPolicyCode
+      cxlPolicyDesc
+      guarPolicyCode
+      guarPolicyDesc
+    }
+    numAdults
+    numChildren
+    ratePlan {
+      confidentialRates
+      hhonorsMembershipRequired
+      advancePurchase
+      promoCode
+      disclaimer {
+        diamond48
+        diamond48_noTx: diamond48
+        fullPrePayNonRefundable
+        fullPrePayNonRefundable_noTx: fullPrePayNonRefundable
+        hhonorsCancellationCharges
+        hhonorsCancellationCharges_noTx: hhonorsCancellationCharges
+        hhonorsPointsDeduction
+        hhonorsPointsDeduction_noTx: hhonorsPointsDeduction
+        hhonorsPrintedConfirmation
+        hhonorsPrintedConfirmation_noTx: hhonorsPrintedConfirmation
+        lengthOfStay
+        lengthOfStay_noTx: lengthOfStay
+        rightToCancel
+        rightToCancel_noTx: rightToCancel
+        totalRate
+        totalRate_noTx: totalRate
+        cancellationRefundPolicy
+        cancellationRefundPolicy_noTx: cancellationRefundPolicy
+      }
+      ratePlanCode
+      ratePlanName
+      ratePlanDesc
+      ratePlanDesc_noTx: ratePlanDesc
+      specialRateType
+      serviceChargesAndTaxesIncluded
+    }
+    roomType {
+      adaAccessibleRoom
+      carousel(first: 1) {
+        altText
+        variants(filter: {size: md}) {
+          url
+        }
+      }
+      roomTypeCode
+      roomTypeName
+      roomTypeDesc
+      roomOccupancy
+    }
+  }
+  roomUpgradesAvailable @include(if: $includePreArrivalOffers)
+  scaRequired
+  scaType
+  showAutoUpgradeIndicator
+  specialRateOptions {
+    corporateId
+    groupCode
+    hhonors
+    lta
+    pnd
+    promoCode
+    travelAgent
+    familyAndFriends
+    teamMember
+    owner
+    ownerHGV
+    smb
+  }
+  taxPeriods {
+    taxes {
+      description
+    }
+  }
+  totalNumAdults
+  totalNumChildren
+  totalNumRooms
+  unlimitedRewardsNumber
+}`
+]);
 // src/merchant-card-endpoint-profiles.js
 var MERCHANT_CARD_ENDPOINT_PSP = "merchant_card_endpoint";
 var MERCHANT_CARD_ENDPOINT_MODE = "card_endpoint";
 var BROWSER_HEADERS = /* @__PURE__ */ Object.freeze(["user-agent", "accept", "accept-language", "sec-ch-ua", "sec-ch-ua-mobile", "sec-ch-ua-platform"]);
+var NAVIGATION_HEADERS = /* @__PURE__ */ Object.freeze([
+    "content-type",
+    "cache-control",
+    "upgrade-insecure-requests",
+    "sec-fetch-dest",
+    "sec-fetch-mode",
+    "sec-fetch-site",
+    "sec-fetch-user"
+]);
+var GUARANTEE_RATES = "a policy for guarantee rates: the hotel charges the card at the stay, by when a single-use card may have closed";
 var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
     {
         id: "att_payment_info",
@@ -144,13 +658,17 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         ],
         har: null,
         checkout: "https://www.att.com",
+        checkout_frame: false,
+        frame: null,
         endpoint: "https://www.att.com",
         method: "POST",
         path: "/msapi/checkoutexporch/v1/paymentInfo",
         query: { cartId: ":cartId" },
+        navigation: null,
         encoding: "json",
         session: {
             cookies: true,
+            cookie_names: null,
             headers: [...BROWSER_HEADERS, "content-type", "x-csrf-token", "appname", "idpctx-appname"],
             required: ["x-csrf-token", "appname"]
         },
@@ -159,9 +677,13 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
             cvv: { at: ["cvv"], format: "digits" },
             exp_month: { at: ["expDate"], format: "as_typed" },
             exp_year: { at: ["expYear"], format: "as_typed" },
+            expiry: null,
+            last4: null,
+            leading: null,
             brands: [{ at: ["cardSubType"], map: null }],
             bins: null
         },
+        merchant_key: null,
         requires: [{ at: ["type"], one_of: ["CREDIT", "DEBIT", "ANYCARD"] }],
         refuse: [
             { at: ["savedPaymentData"], when: "present" },
@@ -171,12 +693,17 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
             { at: ["statusCode"], when: "present" },
             { at: ["includeAutoPay"], when: "true" }
         ],
+        payment_method: null,
         amount: { at: ["amount"], kind: "decimal_string" },
         currency: "USD",
-        response: { headers: ["content-type", "set-cookie", "x-csrf-token"] },
+        response: { headers: ["content-type", "set-cookie", "x-csrf-token"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
         bootstrap: "/robots.txt",
         timeout_ms: 3e4,
         charge_timing: "deferred",
+        once_per: null,
         pending: [
             "card.brands: the cardSubType value for each brand",
             "card.exp_month and card.exp_year: how many digits expDate and expYear carry",
@@ -195,13 +722,17 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         ],
         har: null,
         checkout: "https://biglietti.italotreno.com",
+        checkout_frame: false,
+        frame: null,
         endpoint: "https://api-biglietti.italotreno.com",
         method: "POST",
         path: "/api/v1/booking/:bookingId/payments/credit-card",
         query: {},
+        navigation: null,
         encoding: "json",
         session: {
             cookies: false,
+            cookie_names: null,
             headers: [...BROWSER_HEADERS, "content-type", "authorization", "x-big-working-session-id"],
             required: ["authorization", "x-big-working-session-id"]
         },
@@ -210,20 +741,29 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
             cvv: { at: ["CVV"], format: "digits" },
             exp_month: { at: ["expirationMonth"], format: "mm" },
             exp_year: { at: ["expirationYear"], format: "yyyy_int" },
+            expiry: null,
+            last4: null,
+            leading: null,
             brands: [{ at: ["paymentMethodCode"], map: { visa: "VI", mastercard: "MC" } }],
             bins: null
         },
+        merchant_key: null,
         requires: [{ at: ["termsAndConditions"], equals: true }],
         refuse: [
             { at: ["StoreCreditCard"], when: "true" },
             { at: ["creditCardId"], when: "present" }
         ],
+        payment_method: null,
         amount: null,
         currency: "EUR",
-        response: { headers: ["content-type"] },
+        response: { headers: ["content-type"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
         bootstrap: "/robots.txt",
         timeout_ms: 3e4,
         charge_timing: "at_request",
+        once_per: null,
         pending: [
             "whether the validationMetadata.PaReq answer carries the card number",
             "whether expire is sent absent or as null"
@@ -241,13 +781,17 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         ],
         har: null,
         checkout: "https://www.universalorlando.com",
+        checkout_frame: false,
+        frame: null,
         endpoint: "https://secure-api.universalparks.com",
         method: "POST",
         path: "/instances/:instanceId/commerce-checkout",
         query: {},
+        navigation: null,
         encoding: "json",
         session: {
             cookies: false,
+            cookie_names: null,
             headers: [
                 ...BROWSER_HEADERS,
                 "content-type",
@@ -271,9 +815,13 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
             cvv: { at: ["cvv"], format: "digits" },
             exp_month: { at: ["expiration", "month"], format: "m_int" },
             exp_year: { at: ["expiration", "year"], format: "yyyy_int" },
+            expiry: null,
+            last4: null,
+            leading: null,
             brands: [],
             bins: null
         },
+        merchant_key: null,
         requires: [
             { at: ["currency_code"], equals: "USD" },
             { at: ["order_id"], present: true }
@@ -283,12 +831,17 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
             { at: ["cardinal-3d-secure", "jwt"], when: "nonempty" },
             { at: ["cardinal-3d-secure", "reference_id"], when: "nonempty" }
         ],
+        payment_method: null,
         amount: { at: ["amount"], kind: "decimal_string" },
         currency: { at: ["currency_code"] },
-        response: { headers: ["content-type"] },
+        response: { headers: ["content-type"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
         bootstrap: "/robots.txt",
         timeout_ms: 3e4,
         charge_timing: "at_request",
+        once_per: null,
         pending: ["how long a captured akamai-bm-telemetry header stays accepted"]
     },
     {
@@ -302,13 +855,17 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         ],
         har: null,
         checkout: "https://www.targetoptical.com",
+        checkout_frame: false,
+        frame: null,
         endpoint: "https://www.targetoptical.com",
         method: "POST",
         path: "/AjaxOrderChangeServicePIAddTO",
         query: {},
+        navigation: null,
         encoding: "form",
         session: {
             cookies: true,
+            cookie_names: null,
             headers: [...BROWSER_HEADERS, "content-type", "x-requested-with"],
             required: ["x-requested-with"]
         },
@@ -317,9 +874,13 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
             cvv: { at: "cc_cvc", format: "digits" },
             exp_month: { at: "expire_month", format: "as_typed" },
             exp_year: { at: "expire_year", format: "as_typed" },
+            expiry: null,
+            last4: null,
+            leading: null,
             brands: [{ at: "cc_brand", map: null }, { at: "payMethodId", map: null }],
             bins: null
         },
+        merchant_key: null,
         requires: [
             { at: "requesttype", equals: "ajax" },
             { at: "authToken", present: true },
@@ -329,12 +890,17 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
             { at: "saveCreditCard", when: "present" },
             { at: "creditCardToUse", when: "present" }
         ],
+        payment_method: null,
         amount: { at: "piAmount", kind: "decimal_string" },
         currency: "USD",
-        response: { headers: ["content-type", "set-cookie"] },
+        response: { headers: ["content-type", "set-cookie"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
         bootstrap: "/robots.txt",
         timeout_ms: 3e4,
         charge_timing: "deferred",
+        once_per: null,
         pending: [
             "card.brands: the cc_brand and payMethodId values for each brand",
             "card.exp_month and card.exp_year: how many digits expire_month and expire_year carry",
@@ -354,13 +920,17 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         ],
         har: null,
         checkout: "https://www.opusvirtualoffices.com",
+        checkout_frame: false,
+        frame: null,
         endpoint: "https://www.opusvirtualoffices.com",
         method: "POST",
         path: "/api/signup/process/payment/",
         query: {},
+        navigation: null,
         encoding: "multipart",
         session: {
             cookies: true,
+            cookie_names: null,
             headers: [...BROWSER_HEADERS, "content-type"],
             required: []
         },
@@ -369,50 +939,2096 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
             cvv: { at: "ccv", format: "digits" },
             exp_month: { at: "expdatem", format: "mm" },
             exp_year: { at: "expdatey", format: "yyyy" },
+            expiry: null,
+            last4: null,
+            leading: null,
             brands: [{ at: "CreditCardType", map: { visa: "1", mastercard: "2" } }],
             bins: { mastercard: ["51", "52", "53", "54", "55"] }
         },
+        merchant_key: null,
         requires: [
             { at: "payment_option", equals: "CreditCard" },
             { at: "uid", present: true },
             { at: "prepaymny", one_of: ["1", "3", "6", "11"] }
         ],
         refuse: [],
+        payment_method: null,
         amount: null,
         currency: "USD",
-        response: { headers: ["content-type", "set-cookie"] },
+        response: { headers: ["content-type", "set-cookie"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
         bootstrap: "/robots.txt",
         timeout_ms: 3e4,
         charge_timing: "recurring",
+        once_per: null,
         pending: [
             "the amount each prepaymny term charges, so the approval can show what the chosen term costs",
             "a renewal policy: each renewal charges the card on file with no approval of its own"
         ]
+    },
+    {
+        id: "delta_payment_details",
+        merchant: "Delta Air Lines",
+        status: "observe",
+        evidence: [
+            "www.delta.com completepurchase 26.9.8 (main.js) and booking-config-2670.json, read Sep 25, 2026: the review-pay page posts JSON with withCredentials to APP_PAYMENT_SUBMIT, https://enterprisepayments-api.delta.com/efop/paymentDetails, after a Luhn check.",
+            "Headers (addBFFHeaders): X-Adapter web, Content-Type and Accept application/json, cartId, appId, channelId, purchasePath, and TransactionId, currencyCode, paymentReferenceId and skymilesNbr when set.",
+            'Body (pipe paymentFormValuesToSaveCreditCardRequestJSON): {cardDetails: {billingAdr, cardHolderName, cardType, expirationMonthNum, expirationYearNum, lastFourDigits, paymentCardNum, paymentCardSecurityCode, paymentType "Credit Card", savedFopId, ...}, paymentType "Credit Card"}; the expiry pipe pads the month to two digits and writes the year as 20YY.',
+            "cardType is the form's creditCardCode; Delta's own eligible-fop-current.json lists VI, CA (Mastercard), AX, DS, JC, DC and TP.",
+            "The answer returns a paymentReferenceId that 3DS (/3ds/initialize, /3ds/authenticate) and the purchase use, with no card. Saving the card to the wallet is a separate request (/wallet/paymentDetailsForWallet) the device never sends."
+        ],
+        har: null,
+        checkout: "https://www.delta.com",
+        checkout_frame: false,
+        frame: null,
+        endpoint: "https://enterprisepayments-api.delta.com",
+        method: "POST",
+        path: "/efop/paymentDetails",
+        query: {},
+        navigation: null,
+        encoding: "json",
+        session: {
+            cookies: true,
+            cookie_names: null,
+            headers: [
+                ...BROWSER_HEADERS,
+                "content-type",
+                "x-adapter",
+                "cartid",
+                "appid",
+                "channelid",
+                "purchasepath",
+                "transactionid",
+                "currencycode",
+                "paymentreferenceid",
+                "skymilesnbr"
+            ],
+            required: ["x-adapter", "cartid"]
+        },
+        card: {
+            pan: { at: ["cardDetails", "paymentCardNum"], format: "digits" },
+            cvv: { at: ["cardDetails", "paymentCardSecurityCode"], format: "digits" },
+            exp_month: { at: ["cardDetails", "expirationMonthNum"], format: "mm" },
+            exp_year: { at: ["cardDetails", "expirationYearNum"], format: "yyyy" },
+            expiry: null,
+            last4: { at: ["cardDetails", "lastFourDigits"], format: "digits" },
+            leading: null,
+            brands: [{ at: ["cardDetails", "cardType"], map: { visa: "VI", mastercard: "CA" } }],
+            bins: null
+        },
+        merchant_key: null,
+        requires: [
+            { at: ["paymentType"], equals: "Credit Card" },
+            { at: ["cardDetails", "paymentType"], equals: "Credit Card" }
+        ],
+        refuse: [{ at: ["cardDetails", "savedFopId"], when: "nonempty" }],
+        payment_method: null,
+        amount: null,
+        currency: "USD",
+        response: { headers: ["content-type", "set-cookie"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
+        bootstrap: "/robots.txt",
+        timeout_ms: 3e4,
+        charge_timing: "deferred",
+        once_per: null,
+        pending: [
+            "the currency: the body names none, and a point of sale outside the US prices in its own"
+        ]
+    },
+    {
+        id: "hilton_create_reservation",
+        merchant: "Hilton",
+        status: "observe",
+        evidence: [
+            "Hilton's reservation app dx-res-ui (www.hilton.com/dx_reservation_app): payment page chunks 70b8777e (Aug 24) and 8a158c4c (Sep 8), _app 6b38675c and c2e248fe (Sep 15), read from archive.org copies Sep 25, 2026. Every Hilton brand property books through it, Hilton San Francisco Union Square (SFOFHHH) included.",
+            "The GraphQL transport fetches POST ${DX_GRAPHQL_CLIENT_URI}?${new URLSearchParams({appName, appVersion, operationName, originalOpName, bl})} with body JSON.stringify({query, operationName, variables}): https://www.hilton.com/graphql/customer, appVersion dx-res-ui:<build>, which URLSearchParams writes as dx-res-ui%3A<build>.",
+            "Headers: Content-Type application/json, dx-platform (web when the page sets none), visitorid, hltclientmessageid, and Authorization Bearer only when there is no webGuestMetadata cookie; a same-origin fetch, so the first-party cookies go with it.",
+            "createReservation variables: {language, input: {totalAmountAfterTax (a number), currencyCode, guarantee: {guarMethodCode, paymentCard: {cardCode (from the typed digits), cardExpireDate, cardNumber, cvvString (only when the rate sets cvvRequired), cardholder fields, paymentId (a saved Honors card)}, deposit}, ...}, scaInput, mfaInput, enrollment, guestUpdate: {preferredAddress, updatePaymentMethod (saves the card to the account)}}.",
+            "SCA (PSD2 or Adyen Protect) sends scaInput {returnUrl, browserInfo} on the first call, answers error 897 and sends createReservation again with {scaId, md, paRes} and the card; MFA (errors 995, 996) sends it again with mfaInput. Both are refused here, so only stays that need neither are paid.",
+            "The body's query is the createReservation operationString with its two fragments, which the transport sends unchanged (z = {query, operationName, variables}). requires pins it to the text the archived Sep 15 _app chunk c2e248fe builds (merchant-card-endpoint-documents.js), so an argument written inline in the document or a second createReservation under an alias is refused."
+        ],
+        har: null,
+        checkout: "https://www.hilton.com",
+        checkout_frame: false,
+        frame: null,
+        endpoint: "https://www.hilton.com",
+        method: "POST",
+        path: "/graphql/customer",
+        query: { appName: "dx-res-ui", appVersion: "dx-res-ui%3A:build", operationName: "createReservation", originalOpName: "createReservation", bl: ":language" },
+        navigation: null,
+        encoding: "json",
+        session: {
+            cookies: true,
+            cookie_names: null,
+            headers: [...BROWSER_HEADERS, "content-type", "authorization", "dx-platform", "visitorid", "hltclientmessageid"],
+            required: ["dx-platform"]
+        },
+        card: {
+            pan: { at: ["variables", "input", "guarantee", "paymentCard", "cardNumber"], format: "digits" },
+            cvv: { at: ["variables", "input", "guarantee", "paymentCard", "cvvString"], format: "digits_if_asked" },
+            exp_month: null,
+            exp_year: null,
+            expiry: { at: ["variables", "input", "guarantee", "paymentCard", "cardExpireDate"], format: "as_typed" },
+            last4: null,
+            leading: null,
+            brands: [{ at: ["variables", "input", "guarantee", "paymentCard", "cardCode"], map: null }],
+            bins: null
+        },
+        merchant_key: null,
+        requires: [
+            { at: ["operationName"], equals: "createReservation" },
+            { at: ["query"], one_of: [...HILTON_CREATE_RESERVATION_DOCUMENTS] }
+        ],
+        refuse: [
+            { at: ["variables", "input", "guarantee", "paymentCard", "paymentId"], when: "present" },
+            { at: ["variables", "scaInput"], when: "nonempty" },
+            { at: ["variables", "mfaInput"], when: "nonempty" },
+            { at: ["variables", "guestUpdate", "updatePaymentMethod"], when: "true" }
+        ],
+        payment_method: null,
+        amount: { at: ["variables", "input", "totalAmountAfterTax"], kind: "decimal_number" },
+        currency: { at: ["variables", "input", "currencyCode"] },
+        response: { headers: ["content-type", "set-cookie"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
+        bootstrap: "/robots.txt",
+        timeout_ms: 3e4,
+        charge_timing: "deferred",
+        once_per: null,
+        pending: [
+            "card.expiry: the form cardExpireDate is sent in",
+            "card.brands: the cardCode value for each brand",
+            "the query: whether createReservation adds language or other variables to it",
+            "the createReservation GraphQL document the live build sends, which requires pins (it holds the archived Sep 15 build's): a document that is not pinned can inline guestUpdate.updatePaymentMethod, scaInput or mfaInput, or alias createReservation twice",
+            GUARANTEE_RATES
+        ]
+    },
+    {
+        id: "ihg_hotel_reservation",
+        merchant: "IHG Hotels & Resorts",
+        status: "observe",
+        evidence: [
+            "IHG pay SPA pay-ng v14.144.1 (chunks 5PVRTMTV, 7U5FHKAZ and AO2OILHC, archive.org copies of Jul 24 and 27, 2026), read Sep 25, 2026; the Sep 5 Common Crawl copy of find-hotels v14.147.0 still sends checkout there.",
+            'ReservationService.createReservation posts the first reservation, JSON with withCredentials, to https://apis.ihg.com/reservations/v3/hotels: {id, imageStatus "COMMIT", segments: [{payment: {paymentByPoints, paymentInformation: {paymentCard}, guaranteeType, billingAddress}, ...}], userProfiles, hotels}.',
+            "paymentCard (getPaymentInformation): {cardCode, expireDate `${expirationMonth}${expirationYear}` (MMYY), cardHolderName, cvvNumber: {token: <CVV>}, cardNumber: {token: <PAN, spaces stripped>}}, plus 3dsData after a PSD2 check.",
+            "Headers: x-ihg-api-key (public client key), content-type application/json; charset=UTF-8, ihg-language, X-IHG-SSO-TOKEN, x-accept-currency (USD), IHG-SellSource, Forter-Token; interceptors add IHG-SessionId and IHG-TransactionId.",
+            "Hotels that set isPaymentServiceInformationRequired first send the PAN to /payments/threedsecure/v1/token and /paymentSetup and put the result in 3dsData, which is refused here; China UnionPay and PayPal set cupTokenId and paymentSource, also refused."
+        ],
+        har: null,
+        checkout: "https://www.ihg.com",
+        checkout_frame: false,
+        frame: null,
+        endpoint: "https://apis.ihg.com",
+        method: "POST",
+        path: "/reservations/v3/hotels",
+        query: {},
+        navigation: null,
+        encoding: "json",
+        session: {
+            cookies: true,
+            cookie_names: null,
+            headers: [
+                ...BROWSER_HEADERS,
+                "content-type",
+                "x-ihg-api-key",
+                "ihg-language",
+                "x-ihg-sso-token",
+                "x-accept-currency",
+                "ihg-sellsource",
+                "forter-token",
+                "ihg-sessionid",
+                "ihg-transactionid"
+            ],
+            required: ["x-ihg-api-key"]
+        },
+        card: {
+            pan: { at: ["segments", 0, "payment", "paymentInformation", "paymentCard", "cardNumber", "token"], format: "digits" },
+            cvv: { at: ["segments", 0, "payment", "paymentInformation", "paymentCard", "cvvNumber", "token"], format: "digits" },
+            exp_month: null,
+            exp_year: null,
+            expiry: { at: ["segments", 0, "payment", "paymentInformation", "paymentCard", "expireDate"], format: "mmyy" },
+            last4: null,
+            leading: null,
+            brands: [{ at: ["segments", 0, "payment", "paymentInformation", "paymentCard", "cardCode"], map: null }],
+            bins: null
+        },
+        merchant_key: null,
+        requires: [
+            { at: ["imageStatus"], equals: "COMMIT" },
+            { at: ["segments", 0, "payment", "guaranteeType"], equals: "STANDARD_GUARANTEE" }
+        ],
+        refuse: [
+            { at: ["segments", 0, "payment", "paymentInformation", "paymentCard", "3dsData"], when: "present" },
+            { at: ["segments", 0, "payment", "paymentInformation", "cupTokenId"], when: "present" },
+            { at: ["segments", 0, "payment", "paymentInformation", "paymentSource"], when: "present" }
+        ],
+        payment_method: null,
+        amount: null,
+        currency: "USD",
+        response: { headers: ["content-type", "set-cookie"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
+        bootstrap: "/robots.txt",
+        timeout_ms: 3e4,
+        charge_timing: "deferred",
+        once_per: null,
+        pending: [
+            "card.brands: the cardCode value for each brand",
+            "card.expiry: that expirationMonth is always two digits, so expireDate is MMYY",
+            "the currency: a hotel outside the US charges in its own, which the body names only as hotels[0].bookingCurrency when it differs from the shopper's",
+            GUARANTEE_RATES
+        ]
+    },
+    {
+        id: "aa_process_payment",
+        merchant: "American Airlines",
+        status: "observe",
+        evidence: [
+            "www.aa.com checkout SPA, builds 26.11.12-radio.0 (Sep 2 to 12) and 26.12.0 (Sep 15 to 20), read from archive.org copies Sep 25, 2026: CREDIT_CARD skips checkout/initiate and executePayment posts the request with httpClient.post(bffServiceUrl + 'processpayment'), same origin, bffServiceUrl /ecommerce/checkout-services/.",
+            "Body (Oi, Ja, wi, then finalizePaymentRequest): {formOfPayments: [{creditCard: {creditCardType (derived from the typed digits), cardNumber, expirationMonth, expirationYear, cvvCode, nameOnCard}, billingAddress, saveCardAttributes, formOfPaymentType 'CREDIT_CARD'}], email, tripInsurance, isRecurringPurchaseSelected, responseVersion 'v2', cartId, userInteractionType, browserDetails}.",
+            "Headers: Angular's X-XSRF-TOKEN from the XSRF-TOKEN cookie and an Authorization header from the interceptors; the aa.com cookies go with the same-origin request.",
+            "THREE_DS_IDENTIFY_SHOPPER or THREE_DS_CHALLENGE_SHOPPER runs adyen-web createFromAction and posts the whole request again, card included, with threeDSStep and threeDSecureInfo; both are refused here, so only payments with no 3DS step are paid."
+        ],
+        har: null,
+        checkout: "https://www.aa.com",
+        checkout_frame: false,
+        frame: null,
+        endpoint: "https://www.aa.com",
+        method: "POST",
+        path: "/ecommerce/checkout-services/processpayment",
+        query: {},
+        navigation: null,
+        encoding: "json",
+        session: {
+            cookies: true,
+            cookie_names: null,
+            headers: [...BROWSER_HEADERS, "content-type", "authorization", "x-xsrf-token"],
+            required: []
+        },
+        card: {
+            pan: { at: ["formOfPayments", 0, "creditCard", "cardNumber"], format: "digits" },
+            cvv: { at: ["formOfPayments", 0, "creditCard", "cvvCode"], format: "digits" },
+            exp_month: { at: ["formOfPayments", 0, "creditCard", "expirationMonth"], format: "as_typed" },
+            exp_year: { at: ["formOfPayments", 0, "creditCard", "expirationYear"], format: "as_typed" },
+            expiry: null,
+            last4: null,
+            leading: null,
+            brands: [{ at: ["formOfPayments", 0, "creditCard", "creditCardType"], map: null }],
+            bins: null
+        },
+        merchant_key: null,
+        requires: [
+            { at: ["formOfPayments", 0, "formOfPaymentType"], equals: "CREDIT_CARD" },
+            { at: ["responseVersion"], equals: "v2" },
+            { at: ["cartId"], present: true }
+        ],
+        refuse: [
+            { at: ["formOfPayments", 0, "threeDSStep"], when: "present" },
+            { at: ["formOfPayments", 0, "threeDSecureInfo"], when: "present" },
+            { at: ["formOfPayments", 0, "saveCardAttributes", "saveCardToAccount"], when: "true" },
+            { at: ["isRecurringPurchaseSelected"], when: "true" }
+        ],
+        payment_method: null,
+        amount: null,
+        currency: "USD",
+        response: { headers: ["content-type", "set-cookie"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
+        bootstrap: "/robots.txt",
+        timeout_ms: 3e4,
+        charge_timing: "at_request",
+        once_per: null,
+        pending: [
+            "card.brands: the creditCardType value for each brand",
+            "card.exp_month and card.exp_year: the form the expiry parser writes them in",
+            "which of authorization and x-xsrf-token the call requires",
+            "whether some shoppers check out on checkout.aa.com, which this profile does not cover"
+        ]
+    },
+    {
+        id: "economybookings_vault",
+        merchant: "EconomyBookings",
+        status: "observe",
+        evidence: [
+            "www.economybookings.com checkout (_app-5ad4b35169e00887, chunks 3450 and 1658, flights payment-ef0a155c) and the vault's own vault.js v1.2 and app.610e8fa01edad0052179.js, read Sep 25, 2026: the page mounts VaultFields, one iframe per card field on https://vault.economybookings.com, and submit() hands the card number frame the booking ids.",
+            "That frame posts the card with jQuery $.ajax, contentType application/json, no cookies and no auth header, to https://vault-api.economybookings.com/api/v1/vault: {cardNumber (digits), cvv, ccExpMonth (parseInt), ccExpYear (parseInt of the two-digit year), cardType ('visa', 'mastercard' or 'amex', from the typed digits), cardHolder, affiliateId, reservationId, requestId, carId, extras, transactionId when resubmitting, ...}.",
+            "The answer is {status, transactionId, redirectUrl}; AwaitingAddressData sends saveAdditionalData with no card and then the card again with the transactionId, which is refused here. The vault charges the processor the booking is routed to from its own servers."
+        ],
+        har: null,
+        checkout: "https://www.economybookings.com",
+        checkout_frame: false,
+        frame: "https://vault.economybookings.com",
+        endpoint: "https://vault-api.economybookings.com",
+        method: "POST",
+        path: "/api/v1/vault",
+        query: {},
+        navigation: null,
+        encoding: "json",
+        session: {
+            cookies: false,
+            cookie_names: null,
+            headers: [...BROWSER_HEADERS, "content-type"],
+            required: []
+        },
+        card: {
+            pan: { at: ["cardNumber"], format: "digits" },
+            cvv: { at: ["cvv"], format: "digits" },
+            exp_month: { at: ["ccExpMonth"], format: "m_int" },
+            exp_year: { at: ["ccExpYear"], format: "yy_int" },
+            expiry: null,
+            last4: null,
+            leading: null,
+            brands: [{ at: ["cardType"], map: { visa: "visa", mastercard: "mastercard" } }],
+            bins: null
+        },
+        merchant_key: null,
+        requires: [
+            { at: ["affiliateId"], equals: "economybookings" },
+            { at: ["reservationId"], present: true }
+        ],
+        refuse: [{ at: ["transactionId"], when: "nonempty" }],
+        payment_method: null,
+        amount: null,
+        currency: "USD",
+        response: { headers: ["content-type"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
+        bootstrap: "/robots.txt",
+        timeout_ms: 3e4,
+        charge_timing: "at_request",
+        once_per: null,
+        pending: [
+            "whether an AwaitingAddressData answer already holds an authorization, since the resubmission it asks for is refused here",
+            "the currency: the booking is priced in the shopper's chosen currency, which the body does not name"
+        ]
+    },
+    {
+        id: "synxis_the_verb_hotel",
+        merchant: "The Verb Hotel",
+        status: "observe",
+        evidence: [
+            "www.theverbhotel.com books on the SynXis Booking Engine (gc.synxis.com/rez.aspx?Hotel=61148 answers 302 to be.synxis.com), chain 16362, hotel 61148. SynXis build ad0d448a02da67422922 (client bundle and checkout chunk 6, deployed Sep 25, 2026), read Sep 25, 2026.",
+            "The confirm loop sends each room through route updateReservation: POST https://be.synxis.com/gw/itinerary/v1/updateReservation, Content-Type application/json; charset=utf-8, Accept application/json,application/x-javascript, Context BE, Accept-Language, ActivityID (sbeSessionID), Authorization only for a signed-in member, credentials include (apisession, sbeSessionID, Imperva and AWSALB cookies).",
+            'Body: {version, Chain: {id}, Reservation: {action "Confirmed", Hotel: {id}, GuestList: [{Role "Primary", PaymentList: [{role "Primary", type "CreditCard", PaymentCard: {cardCode (VI, MC, AX, DS...), cardNumber, cardSecurityCode, expireDate "MM/YY", cardHolder}}], ...}], ...}, Source: {BrowserDetails}}; the expiry input is masked 99/99.',
+            "The hotel's configuration shows no cvvCode field, so cardSecurityCode is sent empty; a later room sends the PaymentToken SynXis returned, and a PSD2 hotel sends consentToStoreCardData, both refused here.",
+            "A RedirectHtml answer with VendorStatus Redirected sends the page through a vendor or 3DS step and then itinerary/v2/ReservationPaymentCallback, with no card."
+        ],
+        har: null,
+        checkout: "https://be.synxis.com",
+        checkout_frame: false,
+        frame: null,
+        endpoint: "https://be.synxis.com",
+        method: "POST",
+        path: "/gw/itinerary/v1/updateReservation",
+        query: {},
+        navigation: null,
+        encoding: "json",
+        session: {
+            cookies: true,
+            cookie_names: null,
+            headers: [...BROWSER_HEADERS, "content-type", "context", "activityid", "authorization"],
+            required: ["context", "activityid"]
+        },
+        card: {
+            pan: { at: ["Reservation", "GuestList", 0, "PaymentList", 0, "PaymentCard", "cardNumber"], format: "digits" },
+            cvv: { at: ["Reservation", "GuestList", 0, "PaymentList", 0, "PaymentCard", "cardSecurityCode"], format: "digits_if_asked" },
+            exp_month: null,
+            exp_year: null,
+            expiry: { at: ["Reservation", "GuestList", 0, "PaymentList", 0, "PaymentCard", "expireDate"], format: "mm/yy" },
+            last4: null,
+            leading: null,
+            brands: [{ at: ["Reservation", "GuestList", 0, "PaymentList", 0, "PaymentCard", "cardCode"], map: { visa: "VI", mastercard: "MC" } }],
+            bins: null
+        },
+        merchant_key: null,
+        requires: [
+            { at: ["Chain", "id"], one_of: [16362, "16362"] },
+            { at: ["Reservation", "Hotel", "id"], one_of: [61148, "61148"] },
+            { at: ["Reservation", "action"], equals: "Confirmed" },
+            { at: ["Reservation", "GuestList", 0, "Role"], equals: "Primary" },
+            { at: ["Reservation", "GuestList", 0, "PaymentList", 0, "type"], equals: "CreditCard" }
+        ],
+        refuse: [
+            { at: ["Reservation", "GuestList", 0, "PaymentList", 0, "PaymentCard", "PaymentToken"], when: "nonempty" },
+            { at: ["Reservation", "GuestList", 0, "PaymentList", 0, "PaymentCard", "consentToStoreCardData"], when: "true" },
+            { at: ["Reservation", "GuestList", 0, "PaymentList", 0, "PaymentCard", "FintechPaymentProvider"], when: "nonempty" },
+            { at: ["Reservation", "GuestList", 0, "PaymentList", 0, "PaymentCard", "InstallmentOptionId"], when: "nonempty" }
+        ],
+        payment_method: null,
+        amount: null,
+        currency: "USD",
+        response: { headers: ["content-type", "set-cookie"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
+        bootstrap: "/robots.txt",
+        timeout_ms: 3e4,
+        charge_timing: "deferred",
+        once_per: null,
+        pending: [
+            "that the primary guest is GuestList[0] and its card PaymentList[0]",
+            "whether the hotel's rates take a deposit at booking or only hold the card",
+            GUARANTEE_RATES
+        ]
+    },
+    {
+        id: "runsignup_register_pay",
+        merchant: "RunSignUp",
+        status: "observe",
+        evidence: [
+            "RunSignUp charges cards through Adyen from its own servers (its posts of Mar 2021, Aug 2021, Nov 2022 and Apr 2025); the browser never calls a processor. Read Sep 25, 2026.",
+            "The pay step is /Race/Register/?regToken=<session>&raceId=<id>&track=pay (46 archived captures of that URL; no capture of the page itself survives). RunSignUp's archived card form posts form.serialize() with jQuery $.ajax to its own URL: payment[cardNumber], payment[cardExpiresMonth] and payment[cardExpiresYear] (menus), payment[cvv] and billing fields.",
+            "The Aug 2023 help screenshot shows the same form: card number, Month and Year menus, CVV, billing fields, Save my credit card, and Confirm Payment."
+        ],
+        har: null,
+        checkout: "https://runsignup.com",
+        checkout_frame: false,
+        frame: null,
+        endpoint: "https://runsignup.com",
+        method: "POST",
+        path: "/Race/Register/",
+        query: { regToken: ":regToken", raceId: ":raceId", track: "pay" },
+        navigation: null,
+        encoding: "form",
+        session: {
+            cookies: true,
+            cookie_names: null,
+            headers: [...BROWSER_HEADERS, "content-type", "x-requested-with"],
+            required: []
+        },
+        card: {
+            pan: { at: "payment[cardNumber]", format: "digits" },
+            cvv: { at: "payment[cvv]", format: "digits" },
+            exp_month: { at: "payment[cardExpiresMonth]", format: "as_typed" },
+            exp_year: { at: "payment[cardExpiresYear]", format: "as_typed" },
+            expiry: null,
+            last4: null,
+            leading: null,
+            brands: [],
+            bins: null
+        },
+        merchant_key: null,
+        requires: [],
+        refuse: [],
+        payment_method: null,
+        amount: null,
+        currency: "USD",
+        response: { headers: ["content-type", "set-cookie"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
+        bootstrap: "/robots.txt",
+        timeout_ms: 3e4,
+        charge_timing: "at_request",
+        once_per: null,
+        pending: [
+            "that Confirm Payment posts the form as an XHR to its own pay step URL, not as a document",
+            "the card field names today: the four above come from an archived form",
+            "the name of the Save my credit card field, for a refuse rule",
+            "card.exp_month and card.exp_year: the values the Month and Year menus send"
+        ]
+    },
+    {
+        id: "mindbody_explore_billing",
+        merchant: "Mindbody",
+        status: "observe",
+        evidence: [
+            "Mindbody Explore (www.mindbodyonline.com/explore, main.e3d3d61c built Sep 18, 2026, chunk 5.54c48f67), read Sep 25, 2026: the studios' own sites (Yoga Flow SF, Black Swan Yoga) sell through Mindbody, and on Explore a new card goes through addBillingInfo.",
+            "addBillingInfo posts {data: {type 'userBilling', attributes}} (the form values and primaryCard false, keys in snake case) to https://prod-mkt-gateway.mindbody.io/v1/user/billing with Content-Type and Accept application/vnd.api+json, X-MB-APP-BUILD, X-MB-APP-NAME, X-MB-APP-VERSION, X-MB-USER-SESSION-ID, X-MB-ON-BEHALF-OF for a dependent, and Authorization Bearer for the signed-in person; a cross-site fetch, so no cookies.",
+            "The card form (AddEditCardForm) takes card_number, cvv, expiration_month, expiration_year and a billing address. The order then pays with the stored card by id (/payments, /compute_total, /process with an SCA redirect), with no card.",
+            "The studios' Branded Web widgets check out in CartV2 on go.mindbodyonline.com, whose add-card call is a Next.js server action no public capture shows; it is not this profile."
+        ],
+        har: null,
+        checkout: "https://www.mindbodyonline.com",
+        checkout_frame: false,
+        frame: null,
+        endpoint: "https://prod-mkt-gateway.mindbody.io",
+        method: "POST",
+        path: "/v1/user/billing",
+        query: {},
+        navigation: null,
+        encoding: "json_api",
+        session: {
+            cookies: false,
+            cookie_names: null,
+            headers: [
+                ...BROWSER_HEADERS,
+                "content-type",
+                "authorization",
+                "x-mb-app-build",
+                "x-mb-app-name",
+                "x-mb-app-version",
+                "x-mb-user-session-id",
+                "x-mb-on-behalf-of"
+            ],
+            required: ["authorization", "x-mb-app-name", "x-mb-user-session-id"]
+        },
+        card: {
+            pan: { at: ["data", "attributes", "card_number"], format: "digits" },
+            cvv: { at: ["data", "attributes", "cvv"], format: "digits" },
+            exp_month: { at: ["data", "attributes", "expiration_month"], format: "as_typed" },
+            exp_year: { at: ["data", "attributes", "expiration_year"], format: "as_typed" },
+            expiry: null,
+            last4: null,
+            leading: null,
+            brands: [],
+            bins: null
+        },
+        merchant_key: null,
+        requires: [
+            { at: ["data", "type"], equals: "userBilling" },
+            { at: ["data", "attributes", "primary_card"], equals: false }
+        ],
+        refuse: [],
+        payment_method: null,
+        amount: null,
+        currency: "USD",
+        response: { headers: ["content-type"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
+        bootstrap: "/robots.txt",
+        timeout_ms: 3e4,
+        charge_timing: "deferred",
+        once_per: null,
+        pending: [
+            "the attribute names addBillingInfo writes, and whether card_number is sent without the spaces the input shows",
+            "card.exp_month and card.exp_year: the values the expiry menus send",
+            "card on file: this request saves the card to the person's Mindbody account and the order charges it by id, which the card-on-file disclosure must cover"
+        ]
+    },
+    {
+        id: "lookfantastic_place_order",
+        merchant: "LookFantastic",
+        status: "observe",
+        evidence: [
+            "THG Ingenuity's shared checkout (checkout.lookfantastic.com, build main.212010dd79e9cb4669a1 of May 2026 and its 673 chunks; the Sep 2025 build has the same shape), read Sep 25, 2026.",
+            "placeOrderViaApiPoller fetches POST /checkout-api/v2/order/place-order once with credentials same-origin and headers Content-Type application/json, sessionId and x-thg-client checkout-web-js, then polls /checkout-api/v2/order/status with no card.",
+            "Body (getPlaceOrderBody): {fullName, payerName, contactNumber, deliveryAddress, emailAddress, optedIntoMarketing, payment: {creditCardNumber, nameOnCard, expirationMonth, expirationYear, cv2, method 'new-credit-card', billingAddress, consentToReuse}, residentId, hasDigitalConsent, deliverySelection, consentGiven, reCaptchaToken, giftCards}.",
+            "Two other card paths reach the same endpoint with no card number: BR-DGE hosted fields (cardDataProvider BRIDGE and a token) and Adyen V2 (method adyen_v2); neither passes this profile's rules. Checkout.com runs only 3DS in the page."
+        ],
+        har: null,
+        checkout: "https://checkout.lookfantastic.com",
+        checkout_frame: false,
+        frame: null,
+        endpoint: "https://checkout.lookfantastic.com",
+        method: "POST",
+        path: "/checkout-api/v2/order/place-order",
+        query: {},
+        navigation: null,
+        encoding: "json",
+        session: {
+            cookies: true,
+            cookie_names: null,
+            headers: [...BROWSER_HEADERS, "content-type", "x-thg-client", "sessionid"],
+            required: ["x-thg-client", "sessionid"]
+        },
+        card: {
+            pan: { at: ["payment", "creditCardNumber"], format: "digits" },
+            cvv: { at: ["payment", "cv2"], format: "digits" },
+            exp_month: { at: ["payment", "expirationMonth"], format: "as_typed" },
+            exp_year: { at: ["payment", "expirationYear"], format: "as_typed" },
+            expiry: null,
+            last4: null,
+            leading: null,
+            brands: [],
+            bins: null
+        },
+        merchant_key: null,
+        requires: [{ at: ["payment", "method"], equals: "new-credit-card" }],
+        refuse: [
+            { at: ["payment", "consentToReuse"], when: "true" },
+            { at: ["payment", "cardDataProvider"], when: "present" },
+            { at: ["reCaptchaToken"], when: "nonempty" }
+        ],
+        payment_method: null,
+        amount: null,
+        currency: "GBP",
+        response: { headers: ["content-type", "set-cookie"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
+        bootstrap: "/robots.txt",
+        timeout_ms: 3e4,
+        charge_timing: "at_request",
+        once_per: null,
+        pending: [
+            "which card path lookfantastic.com has on: its own card fields (this profile), BR-DGE hosted fields or Adyen V2",
+            "card.exp_month and card.exp_year: the form expirationMonth and expirationYear are sent in",
+            "the currency: the order is priced in the shopper's currency_V6 cookie, which the body does not name",
+            "whether the site fills reCaptchaToken, and a policy for a captcha token in the card request"
+        ]
+    },
+    // ── Merchants whose own page encrypts the card under the merchant's key ──────
+    // Each ships in observe with pending items: until a HAR pins a key the device has
+    // no key to encrypt under, and the requests around the card request (a second
+    // token call, a page navigation, a re-sent ciphertext) are not in this mode yet.
+    {
+        id: "hyatt_card_token",
+        merchant: "Hyatt",
+        status: "observe",
+        evidence: [
+            "www.hyatt.com payment app bundles main.c587efa6.js (its SHA-384 is the 2026-03-03 payment page SRI hash) and main.8992684e.js (2026-08-27), read Sep 25, 2026 from web.archive.org: on mount the scapegoat client GETs /v1/cc/secure/key for {publicKey: PEM}; Book My Stay posts same-origin JSON with Content-Type and Accept application/json to /v1/cc/secure/tokens and, in parallel, /v1/cvv/secure/tokens.",
+            "Card body: {pan, type, expYear, expMonth}. pan is node-forge encode64 of RSA-OAEP with md SHA-256 and mgf1 md SHA-1 (module wGyh) over the card number field, type is VS, MC, AX, DS, JC, DC or UP (map {AX: amex, DC: diners, DS: discover, JC: jcb, MC: mastercard, UP: unionpay, VS: visa}), expYear is 20YY and expMonth MM from the MM / YY field. The answer is {Token}.",
+            "Then form.submit() navigates to /{locale}/book/makeReservation with token, cvv (the security code token), encrypted-card-number, credit-card-type, expiry-month and expiry-year. No third-party payment code and no frame load on the page (CSP default-src none, connect-src self)."
+        ],
+        har: null,
+        checkout: "https://www.hyatt.com",
+        checkout_frame: false,
+        frame: null,
+        endpoint: "https://www.hyatt.com",
+        method: "POST",
+        path: "/v1/cc/secure/tokens",
+        query: {},
+        navigation: null,
+        encoding: "json",
+        session: { cookies: true, cookie_names: null, headers: [...BROWSER_HEADERS, "content-type"], required: [] },
+        card: {
+            pan: { at: ["pan"], format: "encrypted", plaintext: "digits" },
+            cvv: null,
+            exp_month: { at: ["expMonth"], format: "mm" },
+            exp_year: { at: ["expYear"], format: "yyyy" },
+            expiry: null,
+            last4: null,
+            leading: null,
+            brands: [{ at: ["type"], map: { visa: "VS", mastercard: "MC", amex: "AX", discover: "DS" } }],
+            bins: null
+        },
+        merchant_key: { scheme: "rsa_oaep", hash: "SHA-256", mgf1: "SHA-1", kid_at: null, keys: [] },
+        requires: [],
+        refuse: [],
+        payment_method: null,
+        amount: null,
+        currency: "USD",
+        response: { headers: ["content-type", "set-cookie"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
+        bootstrap: "/robots.txt",
+        timeout_ms: 3e4,
+        charge_timing: "deferred",
+        once_per: null,
+        pending: [
+            "merchant_key.keys: the key /v1/cc/secure/key serves, pinned by the SHA-256 of its SubjectPublicKeyInfo",
+            "the security code goes to /v1/cvv/secure/tokens in a request of its own (hyatt_cvv_token), sent beside this one, and one approval does not cover both yet",
+            "makeReservation is a page navigation that carries encrypted-card-number, credit-card-type, expiry-month and expiry-year of the typed card, which this mode does not rewrite: whether Hyatt books from the token alone",
+            "whether the card number is encrypted as typed, with spaces",
+            "the booking currency: the request names none, so the profile takes stays priced in US dollars only"
+        ]
+    },
+    {
+        id: "hyatt_cvv_token",
+        merchant: "Hyatt",
+        status: "observe",
+        evidence: [
+            "The same Hyatt bundles: Book My Stay posts {cvv} to /v1/cvv/secure/tokens beside the card token call, cvv being the same RSA-OAEP (SHA-256, MGF1-SHA-1) base64 over the security code made on the field blur. The answer is {EncryptedCVV}, which the page puts in the book form as cvv.",
+            "A saved-card booking posts the same body to the same path, for a card Hyatt already holds."
+        ],
+        har: null,
+        checkout: "https://www.hyatt.com",
+        checkout_frame: false,
+        frame: null,
+        endpoint: "https://www.hyatt.com",
+        method: "POST",
+        path: "/v1/cvv/secure/tokens",
+        query: {},
+        navigation: null,
+        encoding: "json",
+        session: { cookies: true, cookie_names: null, headers: [...BROWSER_HEADERS, "content-type"], required: [] },
+        card: {
+            pan: null,
+            cvv: { at: ["cvv"], format: "encrypted", plaintext: "digits" },
+            exp_month: null,
+            exp_year: null,
+            expiry: null,
+            last4: null,
+            leading: null,
+            brands: [],
+            bins: null
+        },
+        merchant_key: { scheme: "rsa_oaep", hash: "SHA-256", mgf1: "SHA-1", kid_at: null, keys: [] },
+        requires: [],
+        refuse: [],
+        payment_method: null,
+        amount: null,
+        currency: "USD",
+        response: { headers: ["content-type", "set-cookie"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
+        bootstrap: "/robots.txt",
+        timeout_ms: 3e4,
+        charge_timing: "deferred",
+        once_per: null,
+        pending: [
+            "merchant_key.keys: the key /v1/cc/secure/key serves, pinned by the SHA-256 of its SubjectPublicKeyInfo",
+            "one approval for both token calls: this one carries the security code of the card hyatt_card_token carries",
+            "a saved-card booking posts the same body here for a card Hyatt holds, so the request alone does not say whose code it is",
+            "makeReservation is a page navigation this mode does not rewrite (see hyatt_card_token)"
+        ]
+    },
+    {
+        id: "lifemiles_process_payment",
+        merchant: "LifeMiles",
+        status: "observe",
+        evidence: [
+            "website-generic-checkout-ui build d31b93cfe651e5f66a0c on the public CloudFront CDN, read Sep 25, 2026: the card page www.lifemiles.com/checkout-lifemiles posts JSON through axios, without withCredentials, to https://api.lifemiles.com/svc/checkout-new-flow-process-payment (env-config confirmationGeneric), with Accept and Content-Type application/json, realm lifemiles and Authorization Bearer <session token>.",
+            'Body: {partner, language, processType, checkoutId, channel, country, stationId, ipAddress, currency, membershipNumber, deviceFingerPrintId, transactionId, selectedFlexCurve, saveCard, fop: {type: CC, amount: "0", unit: D, parameter: [{code, value}]}}. CCNUMCARD, CCCODCVV and CCFECEXP (the expiry as MMYYYY) are node-rsa pkcs1_oaep SHA-512 base64 under the cardKey in env-config.js; CCBIN is the first 7 digits of the number in the clear; CCFRANCHISE is VI, CA, AX, DC or DS (chunk 481 module 90156); CCTOKEN marks a saved card.',
+            "cardKey is one RSA-2048 key (e = 65537) in the generic checkout, Club LifeMiles hub, member direct and air redemption env-config.js (last modified 2026-02-26). The 3DS calls after this request (payment/processor, payflow/3ds/enrollment and validate) carry only paymentId and checkoutId.",
+            "Multiply Miles (partner mymlm) posts the typed number in the clear to /svc/credit-card-on-file-bin-not-saved before Pay, and Club LifeMiles (clubl) renews monthly, so neither partner is reviewed here."
+        ],
+        har: null,
+        checkout: "https://www.lifemiles.com",
+        checkout_frame: false,
+        frame: null,
+        endpoint: "https://api.lifemiles.com",
+        method: "POST",
+        path: "/svc/checkout-new-flow-process-payment",
+        query: {},
+        navigation: null,
+        encoding: "json",
+        session: { cookies: false, cookie_names: null, headers: [...BROWSER_HEADERS, "content-type", "authorization", "realm"], required: ["authorization", "realm"] },
+        card: {
+            pan: { at: ["fop", "parameter", { code: "CCNUMCARD" }, "value"], format: "encrypted", plaintext: "digits" },
+            cvv: { at: ["fop", "parameter", { code: "CCCODCVV" }, "value"], format: "encrypted", plaintext: "digits" },
+            exp_month: null,
+            exp_year: null,
+            expiry: { at: ["fop", "parameter", { code: "CCFECEXP" }, "value"], format: "encrypted", plaintext: "MMYYYY" },
+            last4: null,
+            leading: { at: ["fop", "parameter", { code: "CCBIN" }, "value"], digits: 7 },
+            brands: [{ at: ["fop", "parameter", { code: "CCFRANCHISE" }, "value"], map: { visa: "VI", mastercard: "CA", amex: "AX", discover: "DS" } }],
+            bins: null
+        },
+        merchant_key: {
+            scheme: "rsa_oaep",
+            hash: "SHA-512",
+            mgf1: "SHA-512",
+            kid_at: null,
+            keys: [{
+                    kid: null,
+                    spki: "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsdiBpp7T3C7Ac6R+FTYimtCNzmQLRrCPVLrUZ2wjhjrGMsfeLt4EPbqw168mtJahzysvB+bjB5XZPiAci//nn+pDQK+x9iXS2Lb0RrTDwS8ey39THybEGw0295g4kQO8ZAw5uc9p+hkVcKwgOIkG5fe8GyQlFMhoySQhj/L75BGsbIbojybsW9AJ9K1KKy0CGCiCre6L5x9kuKfkFR0Q7khWTncmKenbkPOvgQXCg5r4+6Nk15imaiR4O1HKHInkPRSdu19kBYBqVXxXm3lYtY3NCOtPS0irRrAdi4UfT46/81ugvEm7y2xuFv32MSJIAzpAC4jHbB+HUD4sJQpVsQIDAQAB",
+                    sha256: "dc2a6ee45bf21c652dc3286244fa80e455200181e71a6b34d9d9a525a4ecfe79"
+                }]
+        },
+        requires: [
+            { at: ["fop", "type"], equals: "CC" },
+            { at: ["partner"], one_of: ["lmbex", "avanc", "buylm", "tsflm"] }
+        ],
+        refuse: [
+            { at: ["saveCard"], when: "true" },
+            { at: ["fop", "parameter", { code: "CCTOKEN" }], when: "present" }
+        ],
+        payment_method: null,
+        amount: null,
+        currency: { at: ["currency"] },
+        response: { headers: ["content-type"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
+        bootstrap: "/robots.txt",
+        timeout_ms: 3e4,
+        charge_timing: "at_request",
+        once_per: null,
+        pending: [
+            "merchant_key.keys: that api.lifemiles.com decrypts with the cardKey its env-config.js carries (the key pinned here), which only a HAR or a person-run purchase shows",
+            "whether the Akamai bot defense in front of api.lifemiles.com takes the relay's request (a plain GET to www.lifemiles.com answered 403 from Akamai)"
+        ]
+    },
+    {
+        id: "southwest_booking_confirmation",
+        merchant: "Southwest Airlines",
+        status: "observe",
+        evidence: [
+            "www.southwest.com air-booking-v2 14.0.3 bundles and bootstrap data.js, read Sep 25, 2026: processBookingPurchase posts same-origin JSON through use-http to /api/air-booking/v1/air-booking/page/air/booking/confirmation (points, companion and certificate bookings use /confirmation-secure), with x-api-key, x-app-id, x-app-version, x-channel-id and x-user-experience-id.",
+            "The body carries creditCard {cityTown, country, countryCode, encryptedCardNumber, expiration, firstNameOnCard, lastNameOnCard, phoneNumber, provinceRegion, state, streetAddress, streetAddressSecond, zipCode, zipCodeRequired, creditCardType, description, descriptionEnabled, primary, securityCode} and paymentMethodSelected creditcard. expiration is the form value with / made -, securityCode is in the clear.",
+            "encryptedCardNumber is jose EncryptJWT({creditCardNumbers: {cardNumber1: number}}) with protected header {alg, enc: A256CBC-HS512, kid, typ: JWT}, under the key with use enc from the cyberJwks JWKS (https://jwksapi.prod0.tok.jwks-prod.prod.southwest.com/jwks), alg taken from the JWK. creditCardType is VISA, RRVISA, MASTERCARD, AMEX, DISCOVER, DINERS or UATP."
+        ],
+        har: null,
+        checkout: "https://www.southwest.com",
+        checkout_frame: false,
+        frame: null,
+        endpoint: "https://www.southwest.com",
+        method: "POST",
+        path: "/api/air-booking/v1/air-booking/page/air/booking/confirmation",
+        query: {},
+        navigation: null,
+        encoding: "json",
+        session: {
+            cookies: true,
+            cookie_names: null,
+            headers: [...BROWSER_HEADERS, "content-type", "x-api-key", "x-app-id", "x-app-version", "x-channel-id", "x-user-experience-id"],
+            required: ["x-api-key", "x-channel-id"]
+        },
+        card: {
+            pan: { at: ["creditCard", "encryptedCardNumber"], format: "encrypted", plaintext: { claims: ["creditCardNumbers", "cardNumber1"] } },
+            cvv: { at: ["creditCard", "securityCode"], format: "digits" },
+            exp_month: null,
+            exp_year: null,
+            expiry: { at: ["creditCard", "expiration"], format: "MM-YY" },
+            last4: null,
+            leading: null,
+            brands: [{ at: ["creditCard", "creditCardType"], map: { visa: "VISA", mastercard: "MASTERCARD", amex: "AMEX", discover: "DISCOVER" } }],
+            bins: null
+        },
+        merchant_key: { scheme: "jwe", alg: null, enc: "A256CBC-HS512", header: { typ: "JWT" }, keys: [] },
+        requires: [{ at: ["paymentMethodSelected"], equals: "creditcard" }],
+        refuse: [
+            { at: ["creditCard", "descriptionEnabled"], when: "true" },
+            { at: ["creditCard", "primary"], when: "true" },
+            { at: ["savedCreditCardSelected"], when: "true" },
+            { at: ["savedCreditCardToken"], when: "nonempty" },
+            { at: ["selectedCardInfo"], when: "nonempty" },
+            { at: ["fundsCoverTotalFlight"], when: "true" }
+        ],
+        payment_method: null,
+        amount: null,
+        currency: "USD",
+        response: { headers: ["content-type", "set-cookie"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
+        bootstrap: "/robots.txt",
+        timeout_ms: 3e4,
+        charge_timing: "at_request",
+        once_per: null,
+        pending: [
+            "merchant_key.keys: the key the cyberJwks JWKS marks use enc, pinned with its kid by the SHA-256 of its SubjectPublicKeyInfo",
+            "merchant_key.alg: the alg the JWK names, which the page writes into the protected header",
+            "card.expiry: whether expiration carries MM-YY or MM-YYYY",
+            "card.brands: whether the form sends RRVISA for a Rapid Rewards Visa, where the map writes VISA",
+            "a trip insurance purchase sends the same encrypted number to /api/payments/v2/fund-tokens, a second card request this profile does not take",
+            "the page re-encrypts and posts again when the answer names an expired key, which asks for a second approval"
+        ]
+    },
+    {
+        id: "united_card_token",
+        merchant: "United Airlines",
+        status: "observe",
+        evidence: [
+            "www.united.com main.4c89ef80de310ae7ad9d.js (the build a public urlscan.io scan of the live home page loaded on 2026-09-17) and its chunks 1402 and 91359, read Sep 25, 2026 from web.archive.org: for a guest the checkout page GETs /api/User/PublicKeyNonPCI and keeps the Keys[] entry with a PEM PublicKey and its Kid.",
+            "On Buy now getCardTokenSaga posts JSON to /api/user/accountNumberTokenOAEP with X-Authorization-api bearer and Accept-Language: {ProfileCreditCard: {AccountNumberEncrypted, Name, Code, ExpirationDate: MM/YY, SecurityCode}, Kid}. AccountNumberEncrypted is base64 of RSA-OAEP with md SHA-1 (vendor module 53965) over the card number without spaces; SecurityCode is in the clear; Code is the card type GetCreditCardType answered. The answer carries AccountNumberToken and PersistentToken.",
+            "The purchase saga waits for that token, then posts CompletePurchase with AccountNumberEncrypted again, AccountNumberLastFourDigits and the tokens; Lookup3DS sends the ciphertext again. GetCreditCardType and GetSecureCardToken receive the first 10 digits of the typed number."
+        ],
+        har: null,
+        checkout: "https://www.united.com",
+        checkout_frame: false,
+        frame: null,
+        endpoint: "https://www.united.com",
+        method: "POST",
+        path: "/api/user/accountNumberTokenOAEP",
+        query: {},
+        navigation: null,
+        encoding: "json",
+        session: { cookies: true, cookie_names: null, headers: [...BROWSER_HEADERS, "content-type", "x-authorization-api"], required: ["x-authorization-api"] },
+        card: {
+            pan: { at: ["ProfileCreditCard", "AccountNumberEncrypted"], format: "encrypted", plaintext: "digits" },
+            cvv: { at: ["ProfileCreditCard", "SecurityCode"], format: "digits" },
+            exp_month: null,
+            exp_year: null,
+            expiry: { at: ["ProfileCreditCard", "ExpirationDate"], format: "MM/YY" },
+            last4: null,
+            leading: null,
+            brands: [{ at: ["ProfileCreditCard", "Code"], map: null }],
+            bins: null
+        },
+        merchant_key: { scheme: "rsa_oaep", hash: "SHA-1", mgf1: "SHA-1", kid_at: ["Kid"], keys: [] },
+        requires: [],
+        refuse: [],
+        payment_method: null,
+        amount: null,
+        currency: "USD",
+        response: { headers: ["content-type", "set-cookie"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
+        bootstrap: "/robots.txt",
+        timeout_ms: 3e4,
+        charge_timing: "deferred",
+        once_per: null,
+        pending: [
+            "merchant_key.keys: the key /api/User/PublicKeyNonPCI serves and its Kid, pinned by the SHA-256 of its SubjectPublicKeyInfo",
+            "card.brands: the Code GetCreditCardType answers for each network",
+            "card.expiry: whether ExpirationDate carries MM/YY or MM/YYYY",
+            "CompletePurchase and Lookup3DS send AccountNumberEncrypted again with the typed card, and its last four digits, which this mode does not rewrite: whether United charges from AccountNumberToken alone",
+            "GetCreditCardType and GetSecureCardToken receive the first 10 digits of the typed card, so the card type and the Cardinal token describe it and not the real card"
+        ]
+    },
+    // ── Document form navigations: the page submits a form that navigates ──────
+    {
+        id: "myrec_athens_clarke_payment",
+        merchant: "Athens-Clarke County Leisure Services",
+        status: "observe",
+        evidence: [
+            `secure.myrecdept.com/auth/default.aspx?did=54048 (MyRec), archive.org captures of 2026-03-20 (200, "Online Payment for Athens-Clarke County Leisure Services") and 2026-05-29, read Sep 25, 2026: an ASP.NET WebForms page whose form aspnetForm posts back to ./default.aspx?did=54048&authkey=<a GUID per checkout> as a full document navigation; the card fields and the submit button sit outside the page's only UpdatePanel, and no async trigger is registered.`,
+            "Card fields: ctl00$Content$txtAccountNumber (maxlength 16), ctl00$Content$txtCvvNumber (maxlength 4), ctl00$Content$lstExpMonth (01 to 12) and ctl00$Content$lstExpYear (four digits), beside the billing name, address, email and phone, __EVENTTARGET, __VIEWSTATE, __VIEWSTATEGENERATOR, __EVENTVALIDATION, and the button that posted: ctl00$Content$btnSubmitPayment, or ctl00$Content$btnCancel.",
+            "A visible reCAPTCHA v2 checkbox sits above the submit button on every capture since 2025-09, so a solved g-recaptcha-response rides in the same body. The page expires after 15 minutes.",
+            "MyRec charges the department's gateway (Authorize.Net here, by the page path) from its own servers; the browser never contacts a processor. The same page serves every MyRec department, each under its own did."
+        ],
+        har: null,
+        checkout: "https://secure.myrecdept.com",
+        checkout_frame: false,
+        frame: null,
+        endpoint: "https://secure.myrecdept.com",
+        method: "POST",
+        path: "/auth/default.aspx",
+        query: { did: "54048", authkey: ":authkey" },
+        navigation: "top",
+        encoding: "form",
+        session: {
+            cookies: true,
+            cookie_names: ["ASP.NET_SessionId"],
+            headers: [...BROWSER_HEADERS, ...NAVIGATION_HEADERS],
+            required: []
+        },
+        card: {
+            pan: { at: "ctl00$Content$txtAccountNumber", format: "digits" },
+            cvv: { at: "ctl00$Content$txtCvvNumber", format: "digits" },
+            exp_month: { at: "ctl00$Content$lstExpMonth", format: "mm" },
+            exp_year: { at: "ctl00$Content$lstExpYear", format: "yyyy" },
+            expiry: null,
+            last4: null,
+            leading: null,
+            brands: [],
+            bins: null
+        },
+        merchant_key: null,
+        requires: [
+            { at: "ctl00$Content$btnSubmitPayment", present: true },
+            { at: "__EVENTTARGET", equals: "" },
+            { at: "__VIEWSTATE", present: true },
+            { at: "__EVENTVALIDATION", present: true }
+        ],
+        refuse: [
+            { at: "ctl00$Content$btnCancel", when: "present" },
+            { at: "g-recaptcha-response", when: "nonempty" }
+        ],
+        payment_method: null,
+        amount: null,
+        currency: "USD",
+        response: { headers: ["content-type", "location", "set-cookie"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
+        bootstrap: "/robots.txt",
+        timeout_ms: 6e4,
+        charge_timing: "at_request",
+        once_per: { query: "authkey" },
+        pending: [
+            "a policy for the solved reCAPTCHA token the page sends in the same body (refused until then), and whether MyRec checks it against the address that posts",
+            "which cookies the postback needs: ASP.NET_SessionId, another, or none",
+            "the answer to the card postback (a redirect, a processing page or the form again) and how long it takes: the page says processing can take 1 to 2 minutes, longer than the 60 second session",
+            "that the bootstrap path answers without a server error"
+        ]
+    },
+    {
+        id: "ladot_etims_guest_permit",
+        merchant: "City of Los Angeles guest parking permits",
+        status: "observe",
+        evidence: [
+            "wmq.etimspayments.com/pbw/include/la/rppguestinput.jsp (Conduent eTIMS Pay By Web), fetched Sep 25, 2026: the guest permit account check posts to /pbw/rppGuestInputAction.doh with hidden clientcode=17 and clientAccount=9, the Los Angeles client account that citations and permit renewals share. No payment SDK or processor frame on any Los Angeles page.",
+            "shared/js/common.js (live, and the same function in the 2005 to 2012 archived copies) clears document.submitForm.cardNumber: eTIMS collects the card in its own form, submitForm, field cardNumber.",
+            "Archived Los Angeles visits (2024-12-04, 2025-09-15) run input.jsp, inputAction.doh, virtualMerchantPBWSubmitPage.doh and confirmAction.doh; Arlington County's renewal journey on the same template runs rppVirtualMerchantSubmitAction.doh, the permit action this profile pins by analogy. eTIMS then charges Elavon Virtual Merchant from its own server.",
+            "Every eTIMS form posts as a document navigation, bound to the HttpOnly JSESSIONID cookie each page sets."
+        ],
+        har: null,
+        checkout: "https://wmq.etimspayments.com",
+        checkout_frame: false,
+        frame: null,
+        endpoint: "https://wmq.etimspayments.com",
+        method: "POST",
+        path: "/pbw/rppVirtualMerchantSubmitAction.doh",
+        query: {},
+        navigation: "top",
+        encoding: "form",
+        session: {
+            cookies: true,
+            cookie_names: ["JSESSIONID"],
+            headers: [...BROWSER_HEADERS, ...NAVIGATION_HEADERS],
+            required: []
+        },
+        card: {
+            pan: { at: "cardNumber", format: "digits" },
+            cvv: { at: "cvv", format: "digits" },
+            exp_month: { at: "expMonth", format: "as_typed" },
+            exp_year: { at: "expYear", format: "as_typed" },
+            expiry: null,
+            last4: null,
+            leading: null,
+            brands: [],
+            bins: null
+        },
+        merchant_key: null,
+        requires: [{ at: "clientcode", equals: "17" }],
+        refuse: [],
+        payment_method: null,
+        amount: null,
+        currency: "USD",
+        response: { headers: ["content-type", "location", "set-cookie"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
+        bootstrap: "/robots.txt",
+        timeout_ms: 6e4,
+        charge_timing: "at_request",
+        once_per: { cookie: "JSESSIONID" },
+        pending: [
+            "the guest permit card action: rppVirtualMerchantSubmitAction.doh is the renewal action on the same template, and the guest flow's own is not archived",
+            "card.cvv, card.exp_month and card.exp_year: only cardNumber has been seen, so these names stand in until a HAR shows the real ones and the expiry's digit counts",
+            "whether the card form carries clientcode 17, and which of its buttons post to the same action",
+            "which request carries the card: the submit action or the confirmAction.doh step after it",
+            "that the Virtual Merchant step does not hand the browser to Converge's hosted page, which would make this Converge processor work instead",
+            "the answer to the card post, and whether it echoes the card",
+            "whether JSESSIONID changes after each payment, which once_per relies on: a session that outlives one payment would refuse the next permit paid in it as the same checkout",
+            "that the bootstrap path answers without a server error"
+        ]
+    },
+    {
+        id: "sfmta_etims_citation",
+        merchant: "San Francisco parking citations",
+        status: "observe",
+        evidence: [
+            "sfmta.com/onlinecitation answers 301 to wmq.etimspayments.com/pbw/include/sanfrancisco/input.jsp (fetched Sep 25, 2026): Conduent eTIMS Pay By Web, clientcode 19. The lookup form posts to /pbw/inputAction.doh behind an image CAPTCHA, and the results form posts to /pbw/selectAction.doh with paymentMethod=card.",
+            "shared/js/common.js clears document.submitForm.cardNumber: eTIMS collects the card in its own form, submitForm, field cardNumber, beside the name on the card, billing address, expiry month (05 - May), expiry year and security code, as a public San Francisco automation example lists them.",
+            "Archived San Francisco visits (2023-10 to 2026-04) run input.jsp, inputAction.doh, selectAction.doh, then transFirstPBWMultiStepSubmitPage.doh (the card, after about 40 seconds of typing) and confirmAction.doh, the review step that completes the charge. eTIMS charges TransFirst Transaction Express from its own server.",
+            "Every eTIMS form posts as a document navigation, bound to the HttpOnly JSESSIONID cookie each page sets."
+        ],
+        har: null,
+        checkout: "https://wmq.etimspayments.com",
+        checkout_frame: false,
+        frame: null,
+        endpoint: "https://wmq.etimspayments.com",
+        method: "POST",
+        path: "/pbw/transFirstPBWMultiStepSubmitPage.doh",
+        query: {},
+        navigation: "top",
+        encoding: "form",
+        session: {
+            cookies: true,
+            cookie_names: ["JSESSIONID"],
+            headers: [...BROWSER_HEADERS, ...NAVIGATION_HEADERS],
+            required: []
+        },
+        card: {
+            pan: { at: "cardNumber", format: "digits" },
+            cvv: { at: "cvv", format: "digits" },
+            exp_month: { at: "expMonth", format: "as_typed" },
+            exp_year: { at: "expYear", format: "as_typed" },
+            expiry: null,
+            last4: null,
+            leading: null,
+            brands: [],
+            bins: null
+        },
+        merchant_key: null,
+        requires: [{ at: "clientcode", equals: "19" }],
+        refuse: [],
+        payment_method: null,
+        amount: null,
+        currency: "USD",
+        response: { headers: ["content-type", "location", "set-cookie"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
+        bootstrap: "/robots.txt",
+        timeout_ms: 6e4,
+        charge_timing: "deferred",
+        once_per: { cookie: "JSESSIONID" },
+        pending: [
+            "card.cvv, card.exp_month and card.exp_year: only cardNumber has been seen, so these names stand in until a HAR shows the real ones and the expiry's digit counts",
+            "whether the card form carries clientcode 19, and which of its buttons post to the same action",
+            "whether the review page or confirmAction.doh, which the agent submits after the card, carries or echoes the card",
+            "the answer to the card post, and whether it echoes the card",
+            "whether JSESSIONID changes after each payment, which once_per relies on: a session that outlives one payment would refuse the next citation paid in it as the same checkout",
+            "that the bootstrap path answers without a server error"
+        ]
+    },
+    {
+        id: "dedge_hotel_card_form",
+        merchant: "D-EDGE hotel booking",
+        status: "observe",
+        evidence: [
+            "HUMA Kotor Bay Hotel & Villas books through D-EDGE (secure-hotel-booking.com/d-edge/HUMA-Kotor-Bay-Hotel-Villas/J6UZ); D-EDGE's payment hub on pay.secure-hotel-booking.com (main.bundle.js, Last-Modified 2026-09-10) renders a CreditCard provider as an iframe at window.cardFrameUrl, card.secure-hotel-booking.com/<the session uuid>.",
+            "The card frame, PciCardForm (archive.org 2026-07-06, 2026-07-23 and 2026-09-04), posts form action /validate/<session uuid>/Default natively, as a navigation of the iframe: hidden Id (the same uuid), CardNumber (maxlength 22), Month (1 to 12, no leading zero), Year (four digits), Cvv (maxlength 4) and CardHolderName. No processor SDK in the frame; D-EDGE charges from its own servers (WSPay for this hotel, by its terms).",
+            "The frame also posts the card's first 8 digits to /cardCss/<session uuid>/Default to pick the card logo, which carries no full card and is not this request.",
+            "secure-hotel-booking.com sits behind DataDome. The same card frame serves every D-EDGE hotel, so the profile names D-EDGE rather than one hotel; its currency is HUMA's."
+        ],
+        har: null,
+        checkout: "https://card.secure-hotel-booking.com",
+        checkout_frame: false,
+        frame: null,
+        endpoint: "https://card.secure-hotel-booking.com",
+        method: "POST",
+        path: "/validate/:session/Default",
+        query: {},
+        navigation: "frame",
+        encoding: "form",
+        session: {
+            cookies: true,
+            cookie_names: ["datadome"],
+            headers: [...BROWSER_HEADERS, ...NAVIGATION_HEADERS],
+            required: []
+        },
+        card: {
+            pan: { at: "CardNumber", format: "digits" },
+            cvv: { at: "Cvv", format: "digits" },
+            exp_month: { at: "Month", format: "m" },
+            exp_year: { at: "Year", format: "yyyy" },
+            expiry: null,
+            last4: null,
+            leading: null,
+            brands: [],
+            bins: null
+        },
+        merchant_key: null,
+        requires: [{ at: "Id", equals_path: "session" }],
+        refuse: [],
+        payment_method: null,
+        amount: null,
+        currency: "EUR",
+        response: { headers: ["content-type", "location", "set-cookie"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
+        bootstrap: "/robots.txt",
+        timeout_ms: 6e4,
+        charge_timing: "at_request",
+        once_per: { path: "session" },
+        pending: [
+            "HUMA's own payment step: whether its pay hub offers this card frame or a WSPay redirect (a HAR of one real booking's payment step)",
+            "which cookies the card post needs, with DataDome in front of the host",
+            "whether CardNumber is posted as digits or with the spaces the field allows",
+            "the answer to the card post (a redirect, a 3DS step or a page), and whether a 3DS step sends the card again",
+            "whether D-EDGE charges the card at this step or holds it for the hotel to charge later",
+            "that the bootstrap path answers without a server error"
+        ]
+    },
+    {
+        id: "nic_common_checkout_payment",
+        merchant: "NIC government checkout (Tyler Technologies)",
+        status: "observe",
+        evidence: [
+            "NJMCdirect (NJ Judiciary municipal court payments) sends the browser to NIC Common Checkout, securecheckout.cdc.nicusa.com: the court portal opens CommonCheckPage/Default.aspx?token=<checkout GUID> top-level, a cookie check (?chkCap=Y) answers 302 to /Checkout/Payment?token=<GUID>, and that page sets the HttpOnly token, lang and ASP.NET_SessionId cookies and the F5 cookie TS011b1edc. The archive pairs about 40 checkout tokens with the court's return URL for the same GUID (status success, failure, duplicate or cancel).",
+            "The archived NJ payment page (2026-07-03, structure only): form#paymentForm posts to /Checkout/Payment/ProcessPaymentEntry with Token, PayType (CC only for NJ), CustomerInfo.*, Phone, Email, the card in plain fields CCCardNumber (maxlength 16), CCCardType (VISA, MAST, AMEX, DISC and others, from NIC's BIN lookup), CCExpirationMonth (01 to 12), CCExpirationYear (four digits), CCCardCVV and CCNameOnCard, and the empty ACH, subscriber, PayPal, Gov2Go and Apple Pay fields. No anti-forgery token: the session cookies are the only binding.",
+            "NIC's paymentjs bundle (sha256 f5733609dfe35a6b6ccd24478aacc123e1b7d8817e971275b94e6b80332530d0, byte-identical live, in the archive and on the Florida host): on #submitPayment it appends a hidden submitPayment and submits the form, a top-level navigation. The same URL takes cancelPayment and the PayPal and Gov2Go launch buttons. The Braintree and Tyler Orion drop-ins in the bundle are off for NJ. The only other card-adjacent calls, BinLookup and GetFee, send the first 11 digits and are not this request.",
+            "NIC charges the card from its own servers and sends the browser to the agency's return URL with the checkout token; the agency records the payment inside that return. The amount is set by the agency when it creates the token (NJ folds a non-refundable 3% processing fee into it), so the body names none. The same page serves about 18 state agencies; the ones with NIC's reCAPTCHA put g-recaptcha-response in the body, which this profile refuses."
+        ],
+        har: null,
+        checkout: "https://securecheckout.cdc.nicusa.com",
+        checkout_frame: false,
+        frame: null,
+        endpoint: "https://securecheckout.cdc.nicusa.com",
+        method: "POST",
+        path: "/Checkout/Payment/ProcessPaymentEntry",
+        query: {},
+        navigation: "top",
+        encoding: "form",
+        session: {
+            cookies: true,
+            cookie_names: ["token", "lang", "ASP.NET_SessionId", "TS01*"],
+            headers: [...BROWSER_HEADERS, ...NAVIGATION_HEADERS],
+            required: []
+        },
+        card: {
+            pan: { at: "CCCardNumber", format: "digits" },
+            cvv: { at: "CCCardCVV", format: "digits" },
+            exp_month: { at: "CCExpirationMonth", format: "mm" },
+            exp_year: { at: "CCExpirationYear", format: "yyyy" },
+            expiry: null,
+            last4: null,
+            leading: null,
+            brands: [{ at: "CCCardType", map: { visa: "VISA", mastercard: "MAST", amex: "AMEX", discover: "DISC" } }],
+            bins: null
+        },
+        merchant_key: null,
+        requires: [
+            { at: "PayType", equals: "CC" },
+            { at: "Token", matches: "guid" },
+            { at: "Token", equals_cookie: "token" },
+            { at: "submitPayment", equals: "" }
+        ],
+        refuse: [
+            { at: "cancelPayment", when: "present" },
+            { at: "launchPayPal", when: "present" },
+            { at: "launchGov2Go", when: "present" },
+            { at: "launchGov2GoPay", when: "present" },
+            { at: "ait", when: "present" },
+            { at: "g-recaptcha-response", when: "present" },
+            { at: "CCCardNumberBIN", when: "present" },
+            { at: "SubUserName", when: "nonempty" },
+            { at: "SubPassword", when: "nonempty" },
+            { at: "ACHRoutingNumber", when: "nonempty" },
+            { at: "ACHAccountNumber", when: "nonempty" },
+            { at: "ACHAccountNumberVerify", when: "nonempty" },
+            { at: "ACHNameOnAccount", when: "nonempty" },
+            { at: "ACHBankType", when: "present" },
+            { at: "AuthorizeAch", when: "true" },
+            { at: "PayPalToken", when: "nonempty" },
+            { at: "PaymentApiToken", when: "nonempty" },
+            { at: "Gov2GoPaymentApiPaymentType", when: "nonempty" },
+            { prefix: "ApplePay.PaymentAccount.", when: "nonempty" },
+            { prefix: "EmbeddedCheckoutPayment", when: "present" },
+            { prefix: "braintree", when: "present" }
+        ],
+        payment_method: null,
+        amount: null,
+        currency: "USD",
+        response: { headers: ["content-type", "location", "set-cookie"], withhold: [] },
+        resends: [],
+        challenge: null,
+        facts: null,
+        bootstrap: "/Checkout/bundles/html5SiteLayout",
+        timeout_ms: 6e4,
+        charge_timing: "at_request",
+        once_per: { at: "Token" },
+        pending: [
+            "the answer to a paid post (a 302 to NIC's receipt or straight to the agency's return URL) and to a decline (a redirect back or the form again, and whether it echoes the card, a masked card or the expiry)",
+            "every cookie the checkout sets after its cookie check (each TS01 name, whether lang matters)",
+            "the CCCardType codes NIC's BIN lookup answers for Visa, Mastercard, Amex and Discover cards, credit and debit",
+            "whether NIC's F5 front door and fraud rules accept the post from the relay's address and TLS with cookies minted in the agent's browser, and whether they read Origin, Referer or the sec-fetch headers",
+            "the session's idle timeout, which bounds the approval",
+            "Tyler Technologies' PCI attestation of compliance for this checkout host",
+            "the form action's letter case: the server answers any case, and this profile pauses only the archived spelling, so a page that posts another spelling is not paused"
+        ]
+    },
+    {
+        id: "fastspring_popup_rekordcloud",
+        merchant: "Lexicon",
+        status: "observe",
+        evidence: [
+            "www.lexicondj.com/scripts/checkout.js (sha256 9802ab20), read Sep 26, 2026: loads FastSpring SBL 1.0.5 with data-storefront rekordcloud.onfastspring.com/popup-lexicon; FastSpring is the merchant of record and opens its popup checkout in a cross-origin iframe at https://rekordcloud.onfastspring.com/popup-lexicon/session/{sessionId}.",
+            "FastSpring shared checkout app on cdn.onfastspring.com (foundation.checkout.js sha256 5334d89b doPayment, common.js sha256 21a031fd interceptor), read Sep 25 and 26, 2026: AngularJS $http posts JSON to <session URL>/payment with X-Session-Token from the page's session JSON, never a cookie.",
+            "Body: contact, card {year, month, number (digits in groups of four, one space between), security}, sepa, ach, pad, bacs, upi, cpfNumber, dniNumber, paymentType, subscribe, captcha {token, captchaType}, recipientSelected, autoRenew (when the renewal checkbox shows), fingerprint; PayPal, wallets and bank debits post the same URL with another paymentType.",
+            "Answers: next error, redirect (success), 3ds (Adyen form in the popup), ebanx-3ds (BRL: the page reads the typed card again and posts it to <session URL>/3ds/return-ebanx), antom-3ds and APM redirects.",
+            "The popup document (script#viewdata) and each JSON answer carry order.totalWithTaxValue, order.currency, production, session.captchaRequired, hasRecurring and the selected items with their renewal (future).",
+            "foundation.checkout.js (sha256 5334d89b), read Sep 30, 2026: the page also reads its order from PUT <session URL>/items/<path> (changeQuantity, onAutoRenewChange), POST <session URL>/items/<path> (changeQuantity for an unselected item, acceptOffer) and POST <session URL>/spi/sheerid; the contact fields post /customer/recognize/background when they lose focus (the interceptor drops /background), and the page reads nothing from that answer.",
+            "Turnstile: renderCaptchaWidget runs when the card option is chosen (choosePaymentOptionWithFields), and turnstileCallback stores the token then, so a body holds a token minted before Pay.",
+            "Research: processors-wave2/items/fastspring/DESIGN.md; the popup HTML itself needs a live session and was not read."
+        ],
+        har: null,
+        checkout: "https://rekordcloud.onfastspring.com",
+        checkout_frame: true,
+        frame: null,
+        endpoint: "https://rekordcloud.onfastspring.com",
+        method: "POST",
+        path: "/popup-lexicon/session/:sessionId/payment",
+        query: {},
+        navigation: null,
+        encoding: "json",
+        session: {
+            cookies: false,
+            cookie_names: null,
+            headers: [...BROWSER_HEADERS, "content-type", "x-session-token"],
+            required: ["x-session-token"]
+        },
+        card: {
+            pan: { at: ["card", "number"], format: "grouped4" },
+            cvv: { at: ["card", "security"], format: "digits" },
+            exp_month: { at: ["card", "month"], format: "as_typed" },
+            exp_year: { at: ["card", "year"], format: "as_typed" },
+            expiry: null,
+            last4: null,
+            leading: null,
+            brands: [],
+            bins: null
+        },
+        merchant_key: null,
+        requires: [{ at: ["paymentType"], equals: "card" }],
+        refuse: [
+            // Brazil's EBANX route sends the typed card a second time.
+            { at: ["cpfNumber"], when: "nonempty" },
+            { at: ["dniNumber"], when: "nonempty" },
+            // A gift licenses someone else.
+            { at: ["recipientSelected"], when: "true" },
+            { at: ["recipient"], when: "present" },
+            // FastSpring keeps the card for renewals, which waits on the card-on-file decision.
+            { at: ["autoRenew"], when: "true" },
+            // An invoiced buyer's purchase order, another checkout than this one.
+            { at: ["customerReference"], when: "present" },
+            // Another payment method's details beside the card.
+            { at: ["sepa", "iban"], when: "nonempty" },
+            { at: ["ach", "accountNum"], when: "nonempty" },
+            { at: ["pad", "accountNum"], when: "nonempty" },
+            { at: ["bacs", "accountNumber"], when: "nonempty" },
+            { at: ["googlepay"], when: "nonempty" },
+            { at: ["paymentKlarna"], when: "nonempty" },
+            { at: ["mercadopago"], when: "nonempty" }
+        ],
+        payment_method: { at: ["paymentType"], card: ["card"] },
+        amount: null,
+        currency: "USD",
+        response: { headers: ["content-type"], withhold: [{ at: ["next"], equals: "ebanx-3ds" }] },
+        resends: [{ method: "POST", path: "/popup-lexicon/session/:sessionId/3ds/return-ebanx", query: {} }],
+        // The device may send a body holding a Turnstile token for 240 seconds after the create. The
+        // page minted the token when the card option rendered, before the pause, so this cannot keep
+        // a slow approval from sending an expired one (pending below).
+        challenge: { at: ["captcha", "token"], ttl_ms: 24e4 },
+        facts: {
+            reader: "fastspring_session",
+            // Every answer FastSpring's page reads its order from (refreshPageResponse and
+            // refreshOrderResponse): the popup document, the one-segment calls (/tax, /coupons,
+            // /locale, /exempt), an item's quantity, renewal or add-on change, and a verified discount.
+            responses: [
+                { method: "GET", path: "/popup-lexicon/session/:sessionId", query: {}, format: "html" },
+                { method: "POST", path: "/popup-lexicon/session/:sessionId/:step", query: {}, format: "json" },
+                { method: "GET", path: "/popup-lexicon/session/:sessionId/:step", query: {}, format: "json" },
+                { method: "PUT", path: "/popup-lexicon/session/:sessionId/items/:item", query: {}, format: "json" },
+                { method: "POST", path: "/popup-lexicon/session/:sessionId/items/:item", query: {}, format: "json" },
+                { method: "POST", path: "/popup-lexicon/session/:sessionId/spi/sheerid", query: {}, format: "json" }
+            ],
+            // Customer recognition, posted when a contact field loses focus: the page reads nothing from its answer.
+            inert: [{ method: "POST", path: "/popup-lexicon/session/:sessionId/customer/recognize", query: {} }],
+            bind: "sessionId"
+        },
+        bootstrap: "/robots.txt",
+        timeout_ms: 3e4,
+        // Most of Lexicon's catalog renews monthly. The facts read refuses each renewing
+        // order, and the worst case stays here until a purchase proves that read.
+        charge_timing: "recurring",
+        once_per: null,
+        pending: [
+            "which controller the popup runs (foundation or pinhole) and the exact /payment body it sends",
+            "the popup document URL and the paths of the JSON answers that carry its session state",
+            "whether /payment needs the AWSALB and AWSALBCORS cookies, Origin or Referer",
+            "whether an X-XSRF-TOKEN header rides along",
+            "whether rekordcloud sets session.captchaRequired",
+            "how old a Turnstile token is when the card request pauses: the page mints it when the card option renders, so a body can still reach FastSpring expired inside the 240 seconds (a captcha error, nothing charged, a spent approval) until a preparation flow approves before Pay",
+            "card.number sent grouped or plain; month and year widths",
+            "the session currency for US buyers",
+            "a card-on-file policy for the monthly plans and the add-on, before any order that renews"
+        ]
+    }
+]);
+function wireProjection(profiles) {
+    return deepFreeze(profiles.map(({ evidence, bootstrap, timeout_ms, ...profile }) => ({ ...profile })));
+}
+function clientProjection(profiles) {
+    return deepFreeze(profiles.map(({ evidence, ...profile }) => ({ ...profile })));
+}
+var MERCHANT_CARD_ENDPOINT_RECOGNIZERS = /* @__PURE__ */ wireProjection(MERCHANT_CARD_ENDPOINT_PROFILES);
+var MERCHANT_CARD_ENDPOINT_CLIENT_TABLE = /* @__PURE__ */ clientProjection(MERCHANT_CARD_ENDPOINT_PROFILES);
+function merchantCardEndpointById(id) {
+    return typeof id === "string" ? MERCHANT_CARD_ENDPOINT_CLIENT_TABLE.find((entry) => entry.id === id) ?? null : null;
+}
+function trustedMerchantCardEndpoint(idOrEntry) {
+    const profile = merchantCardEndpointById(typeof idOrEntry === "string" ? idOrEntry : idOrEntry?.id);
+    if (!profile)
+        throw new Error("Refusing to pay: unknown merchant card endpoint.");
+    return profile;
+}
+function merchantCardEndpointRecognizerById(id) {
+    return typeof id === "string" ? MERCHANT_CARD_ENDPOINT_RECOGNIZERS.find((entry) => entry.id === id) ?? null : null;
+}
+function merchantCardEndpointLive(idOrEntry) {
+    const profile = merchantCardEndpointById(typeof idOrEntry === "string" ? idOrEntry : idOrEntry?.id);
+    return !!profile && profile.status === "enabled" && profile.pending.length === 0 && typeof profile.har === "string" && profile.har !== "" && profile.charge_timing !== "recurring" && (profile.merchant_key == null || Array.isArray(profile.merchant_key.keys) && profile.merchant_key.keys.length > 0);
+}
+// src/sha256.js
+var K = /* @__PURE__ */ new Uint32Array([
+    1116352408,
+    1899447441,
+    3049323471,
+    3921009573,
+    961987163,
+    1508970993,
+    2453635748,
+    2870763221,
+    3624381080,
+    310598401,
+    607225278,
+    1426881987,
+    1925078388,
+    2162078206,
+    2614888103,
+    3248222580,
+    3835390401,
+    4022224774,
+    264347078,
+    604807628,
+    770255983,
+    1249150122,
+    1555081692,
+    1996064986,
+    2554220882,
+    2821834349,
+    2952996808,
+    3210313671,
+    3336571891,
+    3584528711,
+    113926993,
+    338241895,
+    666307205,
+    773529912,
+    1294757372,
+    1396182291,
+    1695183700,
+    1986661051,
+    2177026350,
+    2456956037,
+    2730485921,
+    2820302411,
+    3259730800,
+    3345764771,
+    3516065817,
+    3600352804,
+    4094571909,
+    275423344,
+    430227734,
+    506948616,
+    659060556,
+    883997877,
+    958139571,
+    1322822218,
+    1537002063,
+    1747873779,
+    1955562222,
+    2024104815,
+    2227730452,
+    2361852424,
+    2428436474,
+    2756734187,
+    3204031479,
+    3329325298
+]);
+var rotr = (x, n) => x >>> n | x << 32 - n;
+function utf8(text) {
+    const out = [];
+    for (const char of text) {
+        let cp = char.codePointAt(0);
+        if (cp >= 55296 && cp <= 57343)
+            cp = 65533;
+        if (cp < 128)
+            out.push(cp);
+        else if (cp < 2048)
+            out.push(192 | cp >> 6, 128 | cp & 63);
+        else if (cp < 65536)
+            out.push(224 | cp >> 12, 128 | cp >> 6 & 63, 128 | cp & 63);
+        else
+            out.push(240 | cp >> 18, 128 | cp >> 12 & 63, 128 | cp >> 6 & 63, 128 | cp & 63);
+    }
+    return Uint8Array.from(out);
+}
+function sha256Hex(input) {
+    const isBytes2 = Object.prototype.toString.call(input) === "[object Uint8Array]";
+    if (typeof input !== "string" && !isBytes2)
+        throw new TypeError("sha256Hex takes a string or a Uint8Array.");
+    const bytes = typeof input === "string" ? utf8(input) : input;
+    const length = bytes.length;
+    const padded = new Uint8Array((length + 8 >> 6) + 1 << 6);
+    padded.set(bytes);
+    padded[length] = 128;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, Math.floor(length / 536870912));
+    view.setUint32(padded.length - 4, length << 3 >>> 0);
+    const H = new Uint32Array([1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225]);
+    const W = new Uint32Array(64);
+    for (let offset = 0; offset < padded.length; offset += 64) {
+        for (let t = 0; t < 16; t++)
+            W[t] = view.getUint32(offset + t * 4);
+        for (let t = 16; t < 64; t++) {
+            const s0 = rotr(W[t - 15], 7) ^ rotr(W[t - 15], 18) ^ W[t - 15] >>> 3;
+            const s1 = rotr(W[t - 2], 17) ^ rotr(W[t - 2], 19) ^ W[t - 2] >>> 10;
+            W[t] = W[t - 16] + s0 + W[t - 7] + s1 >>> 0;
+        }
+        let a = H[0], b = H[1], c = H[2], d = H[3], e = H[4], f = H[5], g = H[6], h = H[7];
+        for (let t = 0; t < 64; t++) {
+            const t1 = h + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + (e & f ^ ~e & g) + K[t] + W[t] >>> 0;
+            const t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = d + t1 >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = t1 + t2 >>> 0;
+        }
+        H[0] += a;
+        H[1] += b;
+        H[2] += c;
+        H[3] += d;
+        H[4] += e;
+        H[5] += f;
+        H[6] += g;
+        H[7] += h;
+    }
+    return Array.from(H, (word) => word.toString(16).padStart(8, "0")).join("");
+}
+// src/merchant-card-endpoint-keys.js
+var MerchantKeyError = class extends Error {
+    constructor(reason) {
+        super("Refusing to encrypt the card under the merchant's key.");
+        this.name = "MerchantKeyError";
+        this.code = "merchant_key_refused";
+        this.reason = reason;
+    }
+};
+var refuse = (reason) => new MerchantKeyError(reason);
+var MERCHANT_KEY_HASHES = /* @__PURE__ */ Object.freeze({ "SHA-1": 20, "SHA-256": 32, "SHA-512": 64 });
+var MERCHANT_KEY_JWE_ALGS = /* @__PURE__ */ Object.freeze({ "RSA-OAEP": "SHA-1", "RSA-OAEP-256": "SHA-256" });
+var MERCHANT_KEY_JWE_ENCS = /* @__PURE__ */ Object.freeze({
+    "A256CBC-HS512": Object.freeze({ key: 64, iv: 16, tag: 32 }),
+    A256GCM: Object.freeze({ key: 32, iv: 12, tag: 16 })
+});
+var MERCHANT_KEY_SIZES = /* @__PURE__ */ Object.freeze([256, 384, 512]);
+var BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+var BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+var RSA_ALGORITHM = [48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0];
+var MAX_ENCRYPTED_LENGTH = 4096;
+var isBytes = (value) => Object.prototype.toString.call(value) === "[object Uint8Array]";
+function encodeBase64(bytes, url = false) {
+    const alphabet = url ? BASE64URL_ALPHABET : BASE64_ALPHABET;
+    let out = "";
+    for (let i = 0; i < bytes.length; i += 3) {
+        const a = bytes[i];
+        const b = i + 1 < bytes.length ? bytes[i + 1] : 0;
+        const c = i + 2 < bytes.length ? bytes[i + 2] : 0;
+        const triple = a << 16 | b << 8 | c;
+        out += alphabet[triple >> 18 & 63] + alphabet[triple >> 12 & 63];
+        if (i + 1 < bytes.length)
+            out += alphabet[triple >> 6 & 63];
+        else if (!url)
+            out += "=";
+        if (i + 2 < bytes.length)
+            out += alphabet[triple & 63];
+        else if (!url)
+            out += "=";
+    }
+    return out;
+}
+function decodeBase64(text, url = false) {
+    if (typeof text !== "string" || text.length === 0 || text.length > MAX_ENCRYPTED_LENGTH * 2)
+        return null;
+    const alphabet = url ? BASE64URL_ALPHABET : BASE64_ALPHABET;
+    const body = url ? text : text.replace(/={1,2}$/, "");
+    if (!url && text.length % 4 !== 0)
+        return null;
+    if (body.length % 4 === 1)
+        return null;
+    const out = new Uint8Array(Math.floor(body.length * 3 / 4));
+    let bits = 0;
+    let value = 0;
+    let at = 0;
+    for (let i = 0; i < body.length; i += 1) {
+        const digit = alphabet.indexOf(body[i]);
+        if (digit === -1)
+            return null;
+        value = value << 6 | digit;
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            out[at++] = value >> bits & 255;
+            value &= (1 << bits) - 1;
+        }
+    }
+    return encodeBase64(out, url) === text ? out : null;
+}
+var utf8Bytes = (text) => new TextEncoder().encode(text);
+function readElement(der, at, tag) {
+    if (at + 2 > der.length || der[at] !== tag)
+        throw refuse("key");
+    let length = der[at + 1];
+    let start = at + 2;
+    if (length & 128) {
+        const count = length & 127;
+        if (count === 0 || count > 2 || start + count > der.length || der[start] === 0)
+            throw refuse("key");
+        length = count === 1 ? der[start] : der[start] * 256 + der[start + 1];
+        if (length < 128)
+            throw refuse("key");
+        start += count;
+    }
+    if (start + length > der.length)
+        throw refuse("key");
+    return { start, end: start + length };
+}
+function readPositiveInteger(der, at) {
+    const { start, end } = readElement(der, at, 2);
+    if (end === start || der[start] & 128)
+        throw refuse("key");
+    if (der[start] === 0 && (end - start === 1 || !(der[start + 1] & 128)))
+        throw refuse("key");
+    return { bytes: der.subarray(der[start] === 0 ? start + 1 : start, end), end };
+}
+function toBigInt(bytes) {
+    let hex = "";
+    for (let i = 0; i < bytes.length; i += 1)
+        hex += (bytes[i] < 16 ? "0" : "") + bytes[i].toString(16);
+    return BigInt(`0x${hex || "0"}`);
+}
+function toBytes(value, size) {
+    const hex = value.toString(16).padStart(size * 2, "0");
+    if (hex.length !== size * 2)
+        throw refuse("text");
+    const out = new Uint8Array(size);
+    for (let i = 0; i < size; i += 1)
+        out[i] = parseInt(hex.slice(2 * i, 2 * i + 2), 16);
+    return out;
+}
+function modPow(base, exponent, modulus) {
+    let result = 1n;
+    let square = base % modulus;
+    for (let rest = exponent; rest > 0n; rest >>= 1n) {
+        if (rest & 1n)
+            result = result * square % modulus;
+        square = square * square % modulus;
+    }
+    return result;
+}
+function parseMerchantKey(key) {
+    const spki = key && typeof key === "object" ? key.spki : void 0;
+    const pin = key && typeof key === "object" ? key.sha256 : void 0;
+    if (typeof spki !== "string" || spki.length > 1024 || typeof pin !== "string" || !SHA256_HEX.test(pin))
+        throw refuse("key");
+    const der = decodeBase64(spki);
+    if (!der || sha256Hex(der) !== pin)
+        throw refuse("key");
+    const outer = readElement(der, 0, 48);
+    if (outer.end !== der.length || outer.start + RSA_ALGORITHM.length > der.length)
+        throw refuse("key");
+    if (!RSA_ALGORITHM.every((byte, i) => der[outer.start + i] === byte))
+        throw refuse("key");
+    const bits = readElement(der, outer.start + RSA_ALGORITHM.length, 3);
+    if (bits.end !== outer.end || bits.start === bits.end || der[bits.start] !== 0)
+        throw refuse("key");
+    const rsa = readElement(der, bits.start + 1, 48);
+    if (rsa.end !== bits.end)
+        throw refuse("key");
+    const modulus = readPositiveInteger(der, rsa.start);
+    const exponent = readPositiveInteger(der, modulus.end);
+    if (exponent.end !== rsa.end)
+        throw refuse("key");
+    const n = modulus.bytes;
+    if (!MERCHANT_KEY_SIZES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
+        throw refuse("key");
+    const e = exponent.bytes;
+    if (e.length !== 3 || e[0] !== 1 || e[1] !== 0 || e[2] !== 1)
+        throw refuse("key");
+    return Object.freeze({ n: toBigInt(n), size: n.length });
+}
+function subtleOf(crypto) {
+    if (!crypto || !crypto.subtle || typeof crypto.getRandomValues !== "function")
+        throw refuse("crypto");
+    return crypto.subtle;
+}
+async function digest(subtle, hash, bytes) {
+    try {
+        return new Uint8Array(await subtle.digest(hash, bytes));
+    }
+    catch {
+        throw refuse("crypto");
+    }
+}
+async function mgf1(subtle, hash, seed, length) {
+    const out = new Uint8Array(length);
+    const input = new Uint8Array(seed.length + 4);
+    input.set(seed);
+    try {
+        for (let counter = 0, filled = 0; filled < length; counter += 1) {
+            input[seed.length] = counter >>> 24 & 255;
+            input[seed.length + 1] = counter >>> 16 & 255;
+            input[seed.length + 2] = counter >>> 8 & 255;
+            input[seed.length + 3] = counter & 255;
+            const block = await digest(subtle, hash, input);
+            out.set(block.subarray(0, Math.min(block.length, length - filled)), filled);
+            filled += block.length;
+            block.fill(0);
+        }
+        return out;
+    }
+    finally {
+        input.fill(0);
+    }
+}
+function randomBytes(crypto, length) {
+    const out = new Uint8Array(length);
+    try {
+        crypto.getRandomValues(out);
+    }
+    catch {
+        throw refuse("random");
+    }
+    return out;
+}
+async function rsaOaepEncrypt(key, message, { hash, mgf1: maskHash }, crypto, seed) {
+    const subtle = subtleOf(crypto);
+    const { n, size } = parseMerchantKey(key);
+    const hLen = MERCHANT_KEY_HASHES[hash];
+    if (!hLen || !MERCHANT_KEY_HASHES[maskHash])
+        throw refuse("key");
+    if (!isBytes(message) || message.length > size - 2 * hLen - 2)
+        throw refuse("text");
+    const db = new Uint8Array(size - hLen - 1);
+    const em = new Uint8Array(size);
+    let seedBytes = null;
+    let dbMask = null;
+    let seedMask = null;
+    try {
+        db.set(await digest(subtle, hash, new Uint8Array(0)));
+        db[db.length - message.length - 1] = 1;
+        db.set(message, db.length - message.length);
+        if (seed !== void 0) {
+            if (!isBytes(seed) || seed.length !== hLen)
+                throw refuse("random");
+            seedBytes = Uint8Array.from(seed);
+        }
+        else {
+            seedBytes = randomBytes(crypto, hLen);
+        }
+        dbMask = await mgf1(subtle, maskHash, seedBytes, db.length);
+        for (let i = 0; i < db.length; i += 1)
+            db[i] ^= dbMask[i];
+        seedMask = await mgf1(subtle, maskHash, db, hLen);
+        for (let i = 0; i < hLen; i += 1)
+            seedBytes[i] ^= seedMask[i];
+        em.set(seedBytes, 1);
+        em.set(db, 1 + hLen);
+        return toBytes(modPow(toBigInt(em), 65537n, n), size);
+    }
+    finally {
+        db.fill(0);
+        em.fill(0);
+        if (seedBytes)
+            seedBytes.fill(0);
+        if (dbMask)
+            dbMask.fill(0);
+        if (seedMask)
+            seedMask.fill(0);
+    }
+}
+function merchantJweHeader(spec, kid) {
+    return JSON.stringify({ alg: spec.alg, enc: spec.enc, kid, ...spec.header });
+}
+async function aesCbcHmacSeal(subtle, contentKey, iv, text, aad) {
+    let macKey;
+    let encKey;
+    try {
+        macKey = await subtle.importKey("raw", contentKey.subarray(0, 32), { name: "HMAC", hash: "SHA-512" }, false, ["sign"]);
+        encKey = await subtle.importKey("raw", contentKey.subarray(32, 64), { name: "AES-CBC" }, false, ["encrypt"]);
+    }
+    catch {
+        throw refuse("crypto");
+    }
+    let ciphertext;
+    try {
+        ciphertext = new Uint8Array(await subtle.encrypt({ name: "AES-CBC", iv }, encKey, text));
+    }
+    catch {
+        throw refuse("crypto");
+    }
+    const al = new Uint8Array(8);
+    const bits = aad.length * 8;
+    new DataView(al.buffer).setUint32(0, Math.floor(bits / 4294967296));
+    new DataView(al.buffer).setUint32(4, bits >>> 0);
+    const macInput = new Uint8Array(aad.length + iv.length + ciphertext.length + 8);
+    macInput.set(aad, 0);
+    macInput.set(iv, aad.length);
+    macInput.set(ciphertext, aad.length + iv.length);
+    macInput.set(al, aad.length + iv.length + ciphertext.length);
+    let mac;
+    try {
+        mac = new Uint8Array(await subtle.sign("HMAC", macKey, macInput));
+    }
+    catch {
+        throw refuse("crypto");
+    }
+    const tag = mac.slice(0, 32);
+    mac.fill(0);
+    return { ciphertext, tag };
+}
+async function aesGcmSeal(subtle, contentKey, iv, text, aad) {
+    try {
+        const key = await subtle.importKey("raw", contentKey, { name: "AES-GCM" }, false, ["encrypt"]);
+        const sealed = new Uint8Array(await subtle.encrypt({ name: "AES-GCM", iv, additionalData: aad, tagLength: 128 }, key, text));
+        return { ciphertext: sealed.slice(0, sealed.length - 16), tag: sealed.slice(sealed.length - 16) };
+    }
+    catch {
+        throw refuse("crypto");
+    }
+}
+async function jweCompactEncrypt(key, text, spec, kid, crypto) {
+    const subtle = subtleOf(crypto);
+    const hash = MERCHANT_KEY_JWE_ALGS[spec && spec.alg];
+    const enc = MERCHANT_KEY_JWE_ENCS[spec && spec.enc];
+    if (!hash || !enc || typeof kid !== "string" || kid === "")
+        throw refuse("key");
+    if (!isBytes(text))
+        throw refuse("text");
+    const header = encodeBase64(utf8Bytes(merchantJweHeader(spec, kid)), true);
+    const aad = utf8Bytes(header);
+    const contentKey = randomBytes(crypto, enc.key);
+    try {
+        const wrapped = await rsaOaepEncrypt(key, contentKey, { hash, mgf1: hash }, crypto);
+        const iv = randomBytes(crypto, enc.iv);
+        const { ciphertext, tag } = spec.enc === "A256GCM" ? await aesGcmSeal(subtle, contentKey, iv, text, aad) : await aesCbcHmacSeal(subtle, contentKey, iv, text, aad);
+        return [header, encodeBase64(wrapped, true), encodeBase64(iv, true), encodeBase64(ciphertext, true), encodeBase64(tag, true)].join(".");
+    }
+    finally {
+        contentKey.fill(0);
+    }
+}
+function readCompactJwe(value) {
+    if (typeof value !== "string" || value.length > MAX_ENCRYPTED_LENGTH)
+        return null;
+    const parts = value.split(".");
+    if (parts.length !== 5)
+        return null;
+    const bytes = parts.map((part) => decodeBase64(part, true));
+    if (bytes.some((part) => part === null))
+        return null;
+    let headerText;
+    let header;
+    try {
+        headerText = new TextDecoder("utf-8", { fatal: true }).decode(bytes[0]);
+        header = JSON.parse(headerText);
+    }
+    catch {
+        return null;
+    }
+    if (!header || typeof header !== "object" || Array.isArray(header) || JSON.stringify(header) !== headerText)
+        return null;
+    return { header, headerText, encryptedKey: bytes[1], iv: bytes[2], ciphertext: bytes[3], tag: bytes[4] };
+}
+function allowedSizes(merchantKey) {
+    const sizes = [];
+    for (const key of merchantKey.keys) {
+        try {
+            sizes.push(parseMerchantKey(key).size);
+        }
+        catch {
+        }
+    }
+    return merchantKey.keys.length ? sizes : MERCHANT_KEY_SIZES;
+}
+function encryptedValueFits(merchantKey, value) {
+    if (!merchantKey || typeof value !== "string" || value.length > MAX_ENCRYPTED_LENGTH)
+        return false;
+    const sizes = allowedSizes(merchantKey);
+    if (merchantKey.scheme === "rsa_oaep") {
+        const bytes = decodeBase64(value);
+        return !!bytes && sizes.includes(bytes.length);
+    }
+    if (merchantKey.scheme !== "jwe")
+        return false;
+    const jwe = readCompactJwe(value);
+    const enc = MERCHANT_KEY_JWE_ENCS[merchantKey.enc];
+    if (!jwe || !enc)
+        return false;
+    const { header } = jwe;
+    const kids = merchantKey.keys.map((key) => key.kid);
+    const alg = merchantKey.alg === null ? header.alg : merchantKey.alg;
+    if (!Object.prototype.hasOwnProperty.call(MERCHANT_KEY_JWE_ALGS, alg) || typeof header.kid !== "string" || header.kid === "" || kids.length && !kids.includes(header.kid))
+        return false;
+    if (jwe.headerText !== merchantJweHeader({ ...merchantKey, alg }, header.kid))
+        return false;
+    if (!sizes.includes(jwe.encryptedKey.length) || jwe.iv.length !== enc.iv || jwe.tag.length !== enc.tag || jwe.ciphertext.length === 0)
+        return false;
+    return merchantKey.enc === "A256GCM" || jwe.ciphertext.length % 16 === 0;
+}
+// src/merchant-card-endpoint-facts.js
+var TWO_DECIMAL_CURRENCIES = /* @__PURE__ */ new Set(["usd", "eur", "gbp", "cad", "aud"]);
+var MERCHANT_CARD_ENDPOINT_FACTS_TEXT_MAX = 1024 * 1024;
+var MAX_DEPTH = 8;
+var MAX_ITEMS = 256;
+var ROUNDING_MARGIN = 1;
+var fail = (refusal) => ({ ok: false, refusal });
+var VIEWDATA = /<script\b[^>]*\bid\s*=\s*["']viewdata["'][^>]*>([\s\S]*?)<\/script\s*>/gi;
+var ANGULAR_PREFIX = /^\)\]\}',?\n/;
+function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return void 0;
     }
-]);
-function wireProjection(profiles) {
-    return deepFreeze(profiles.map(({ evidence, bootstrap, timeout_ms, ...profile }) => ({ ...profile })));
 }
-function clientProjection(profiles) {
-    return deepFreeze(profiles.map(({ evidence, ...profile }) => ({ ...profile })));
+function fastspringState(format, text) {
+    if (format === "html") {
+        const scripts = [...text.matchAll(VIEWDATA)];
+        if (scripts.length !== 1)
+            return { refusal: "the checkout page does not hold exactly one order record" };
+        const state2 = parseJson(scripts[0][1]);
+        return isPlainObject(state2) ? { state: state2 } : { refusal: "the checkout page's order record is not a JSON object" };
+    }
+    const state = parseJson(text.replace(ANGULAR_PREFIX, ""));
+    if (!isPlainObject(state))
+        return { none: true };
+    return isPlainObject(state.order) && isPlainObject(state.session) ? { state } : { none: true };
 }
-var MERCHANT_CARD_ENDPOINT_RECOGNIZERS = /* @__PURE__ */ wireProjection(MERCHANT_CARD_ENDPOINT_PROFILES);
-var MERCHANT_CARD_ENDPOINT_CLIENT_TABLE = /* @__PURE__ */ clientProjection(MERCHANT_CARD_ENDPOINT_PROFILES);
-function merchantCardEndpointById(id) {
-    return typeof id === "string" ? MERCHANT_CARD_ENDPOINT_CLIENT_TABLE.find((entry) => entry.id === id) ?? null : null;
+function selectedRenewals(groups, depth, counter) {
+    if (!Array.isArray(groups) || depth > MAX_DEPTH)
+        return null;
+    const out = [];
+    for (const group of groups) {
+        if (!isPlainObject(group) || group.items !== void 0 && !Array.isArray(group.items))
+            return null;
+        for (const item of group.items ?? []) {
+            counter.items += 1;
+            if (!isPlainObject(item) || counter.items > MAX_ITEMS)
+                return null;
+            const nested = selectedRenewals(item.groups ?? [], depth + 1, counter);
+            if (nested === null)
+                return null;
+            out.push({ selected: item.selected === true, future: item.future ? true : null, groups: nested });
+        }
+    }
+    return [{ items: out }];
 }
-function trustedMerchantCardEndpoint(idOrEntry) {
-    const profile = merchantCardEndpointById(typeof idOrEntry === "string" ? idOrEntry : idOrEntry?.id);
-    if (!profile)
-        throw new Error("Refusing to pay: unknown merchant card endpoint.");
-    return profile;
+function fastspringProjection(state) {
+    const order = state.order;
+    if (!isPlainObject(order))
+        return null;
+    const groups = selectedRenewals(order.groups ?? [], 0, { items: 0 });
+    if (groups === null)
+        return null;
+    return {
+        order: { totalWithTaxValue: order.totalWithTaxValue, currency: order.currency, groups },
+        production: state.production,
+        hasRecurring: state.hasRecurring === void 0 ? false : state.hasRecurring,
+        forceFuture: state.forceFuture === void 0 ? false : state.forceFuture
+    };
 }
-function merchantCardEndpointRecognizerById(id) {
-    return typeof id === "string" ? MERCHANT_CARD_ENDPOINT_RECOGNIZERS.find((entry) => entry.id === id) ?? null : null;
+function anySelectedRenewal(groups) {
+    return groups.some((group) => group.items.some((item) => item.selected && item.future === true || anySelectedRenewal(item.groups)));
 }
-function merchantCardEndpointLive(idOrEntry) {
-    const profile = merchantCardEndpointById(typeof idOrEntry === "string" ? idOrEntry : idOrEntry?.id);
-    return !!profile && profile.status === "enabled" && profile.pending.length === 0 && typeof profile.har === "string" && profile.har !== "" && profile.charge_timing !== "recurring";
+function minorUnits(value) {
+    if (typeof value !== "number" || !Number.isFinite(value) || value < 0)
+        return null;
+    const match = /^(\d{1,12})(?:\.(\d{1,2}))?$/.exec(String(value));
+    return match ? Number(match[1]) * 100 + Number((match[2] ?? "").padEnd(2, "0")) : null;
+}
+function fastspringFacts(state, merchant) {
+    const unreadable = `${merchant}'s order record is not in the layout Agentcard reviewed`;
+    const projection = isPlainObject(state) ? fastspringProjection(state) : null;
+    if (!projection || JSON.stringify(projection) !== JSON.stringify(state))
+        return fail(unreadable);
+    const { totalWithTaxValue, currency, groups } = projection.order;
+    if (typeof currency !== "string" || !/^[A-Z]{3}$/.test(currency))
+        return fail(unreadable);
+    if (!TWO_DECIMAL_CURRENCIES.has(currency.toLowerCase()))
+        return fail(`${merchant}'s order is in a currency this build does not read`);
+    const amountCents = minorUnits(totalWithTaxValue);
+    if (amountCents === null)
+        return fail(`${merchant}'s order total is not a whole number of cents`);
+    if (typeof projection.production !== "boolean" || typeof projection.hasRecurring !== "boolean" || typeof projection.forceFuture !== "boolean") {
+        return fail(unreadable);
+    }
+    const recurring = projection.hasRecurring || projection.forceFuture || anySelectedRenewal(groups);
+    return { ok: true, facts: { amount: { amountCents, currency: currency.toLowerCase() }, live: projection.production, recurring } };
+}
+var READERS = /* @__PURE__ */ Object.freeze({
+    fastspring_session: Object.freeze({ state: fastspringState, project: fastspringProjection, facts: fastspringFacts })
+});
+var MERCHANT_CARD_ENDPOINT_FACT_READERS = /* @__PURE__ */ Object.freeze(Object.keys(READERS));
+function cardPlaceholders(p, cardUrl) {
+    const match = urlTemplateMatch({ path: p.path, query: p.query }, cardUrl);
+    return match && match.origin === p.endpoint ? match.placeholders : null;
+}
+function boundShape(p, card, shapes, exchange) {
+    const bind = p.facts.bind;
+    for (const shape of shapes) {
+        if (shape.method !== exchange.method.toUpperCase())
+            continue;
+        const match = urlTemplateMatch(shape, exchange.url);
+        if (match && typeof card[bind] === "string" && match.placeholders[bind] === card[bind])
+            return shape;
+    }
+    return null;
+}
+function shapeFor(p, cardUrl, exchange) {
+    if (!p.facts || !isPlainObject(exchange) || typeof exchange.method !== "string" || typeof exchange.url !== "string")
+        return null;
+    const card = cardPlaceholders(p, cardUrl);
+    const url = strictUrl(exchange.url);
+    if (!card || !url || url.origin !== p.endpoint)
+        return null;
+    return boundShape(p, card, p.facts.responses, exchange);
+}
+function sessionPath(p, card) {
+    const segments = p.path.split("/");
+    const at = segments.indexOf(`:${p.facts.bind}`);
+    if (at < 1)
+        return null;
+    const written = segments.slice(0, at + 1).map((segment) => segment.startsWith(":") ? card[segment.slice(1)] : segment);
+    return written.every((segment) => typeof segment === "string") ? written.join("/") : null;
+}
+function merchantCardEndpointFactsRole(profile, cardUrl, exchange) {
+    const p = trustedMerchantCardEndpoint(profile);
+    if (!p.facts || !isPlainObject(exchange) || typeof exchange.method !== "string" || typeof exchange.url !== "string")
+        return null;
+    const card = cardPlaceholders(p, cardUrl);
+    const session = card ? sessionPath(p, card) : null;
+    let url;
+    try {
+        url = new URL(exchange.url);
+    }
+    catch {
+        return null;
+    }
+    if (!session || url.origin !== p.endpoint || url.pathname !== session && !url.pathname.startsWith(`${session}/`))
+        return null;
+    if (exchange.method.toUpperCase() === p.method && exchange.url === cardUrl)
+        return "card";
+    if (shapeFor(p, cardUrl, exchange))
+        return "record";
+    if (boundShape(p, card, p.facts.inert, exchange))
+        return "inert";
+    return "unread";
+}
+function projectMerchantCardEndpointFacts(profile, cardUrl, exchange) {
+    const p = trustedMerchantCardEndpoint(profile);
+    const shape = shapeFor(p, cardUrl, exchange);
+    if (!shape)
+        return { refusal: `the response is not ${p.merchant}'s record of this checkout` };
+    if (!Number.isInteger(exchange.status) || exchange.status < 200 || exchange.status > 299)
+        return { refusal: `${p.merchant}'s record of this checkout did not load` };
+    if (typeof exchange.body !== "string" || exchange.body.length > MERCHANT_CARD_ENDPOINT_FACTS_TEXT_MAX)
+        return { refusal: `${p.merchant}'s record of this checkout could not be read` };
+    const reader = READERS[p.facts.reader];
+    const read = reader.state(shape.format, exchange.body);
+    if (read.none)
+        return { none: true };
+    if (read.refusal)
+        return { refusal: read.refusal };
+    const state = reader.project(read.state);
+    if (!state)
+        return { refusal: `${p.merchant}'s order record is not in the layout Agentcard reviewed` };
+    return { record: { method: shape.method, url: exchange.url, state } };
+}
+function readMerchantCardEndpointFacts(profile, cardUrl, record) {
+    const p = trustedMerchantCardEndpoint(profile);
+    if (!p.facts)
+        return fail(`Agentcard reads no order record for ${p.merchant}`);
+    if (!isPlainObject(record) || Object.keys(record).sort().join(",") !== "method,state,url")
+        return fail(`the order record for ${p.merchant} is malformed`);
+    if (!shapeFor(p, cardUrl, record))
+        return fail(`the order record is not ${p.merchant}'s record of this checkout`);
+    return READERS[p.facts.reader].facts(record.state, p.merchant);
+}
+function merchantCardEndpointFactsRefusal(profile, facts, agent) {
+    const p = trustedMerchantCardEndpoint(profile);
+    const refuse2 = (code, reason) => ({ code, reason });
+    if (!isPlainObject(facts) || !isPlainObject(facts.amount) || !isPlainObject(agent))
+        return refuse2("malformed", `the order record for ${p.merchant} is malformed`);
+    if (facts.recurring !== false)
+        return refuse2("recurring", `${p.merchant}'s order renews on a schedule, and each renewal would charge the card with no approval of its own`);
+    if (facts.live !== agent.live)
+        return agent.live ? refuse2("test_checkout", `${p.merchant}'s checkout is in test mode`) : refuse2("live_checkout", `${p.merchant}'s checkout is live`);
+    if (typeof agent.currency !== "string" || facts.amount.currency !== agent.currency.toLowerCase()) {
+        return refuse2("currency", `${p.merchant}'s order is in another currency than the one approved`);
+    }
+    if (!Number.isSafeInteger(agent.amountCents) || Math.abs(facts.amount.amountCents - agent.amountCents) > ROUNDING_MARGIN) {
+        return refuse2("amount", `${p.merchant}'s own total is not the amount the cardholder would be asked to approve`);
+    }
+    return null;
 }
 // src/merchant-card-endpoints.js
 var MERCHANT_CARD_ENDPOINT_LIMITS = /* @__PURE__ */ Object.freeze({
@@ -428,7 +3044,9 @@ var PRINTABLE_ASCII = /^[\x20-\x7e]*$/;
 var COOKIE_NAME = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]{1,256}$/;
 var COOKIE_VALUE = /^(?:[\x21\x23-\x2b\x2d-\x3a\x3c-\x5b\x5d-\x7e]*|"[\x21\x23-\x2b\x2d-\x3a\x3c-\x5b\x5d-\x7e]*")$/;
 var BOUNDARY = /^[A-Za-z0-9'()+_,\-./:=?]{1,70}$/;
-var BUNDLE_MEMBERS = /* @__PURE__ */ new Set(["url", "page_origin", "headers", "cookies", "referer", "body"]);
+var BUNDLE_MEMBERS = /* @__PURE__ */ new Set(["url", "page_origin", "navigation", "headers", "cookies", "referer", "body"]);
+var SHAPES = /* @__PURE__ */ Object.freeze({ guid: /^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$/ });
+var NAVIGATION_FORM_TYPE = "application/x-www-form-urlencoded";
 function utf8Length(text) {
     let bytes = 0;
     for (let i = 0; i < text.length; i += 1) {
@@ -522,12 +3140,19 @@ function multipartBoundary(contentType) {
     const boundary = match ? match[1] ?? match[2] : null;
     return boundary && BOUNDARY.test(boundary) ? boundary : null;
 }
+function jsonBody(p) {
+    return p.encoding === "json" || p.encoding === "json_api";
+}
 function contentTypeRefusal(p, contentType) {
     if (typeof contentType !== "string")
         return `the card request to ${p.merchant} names no content type`;
-    const ok = p.encoding === "json" ? /^application\/json(?:;\s*charset=utf-8)?$/i.test(contentType) : p.encoding === "form" ? /^application\/x-www-form-urlencoded(?:;\s*charset=utf-8)?$/i.test(contentType) : multipartBoundary(contentType) !== null;
+    const ok = p.encoding === "json" ? /^application\/json(?:;\s*charset=utf-8)?$/i.test(contentType) : p.encoding === "json_api" ? /^application\/vnd\.api\+json(?:;\s*charset=utf-8)?$/i.test(contentType) : p.encoding === "form" ? /^application\/x-www-form-urlencoded(?:;\s*charset=utf-8)?$/i.test(contentType) : multipartBoundary(contentType) !== null;
     return ok ? null : `the card request to ${p.merchant} is not sent as ${p.encoding}`;
 }
+function merchantCardEndpointRequestOrigin(profile) {
+    const p = trustedMerchantCardEndpoint(profile);
+    return p.frame ?? p.checkout;
+}
 function forbiddenKeyIn(value, depth = 0) {
     if (depth > 64)
         return true;
@@ -608,8 +3233,76 @@ function parseMultipart(body, boundary) {
 function sameName(name, wanted) {
     return !FORBIDDEN_KEYS.has(name) && (name.toLowerCase() === wanted.toLowerCase() || name.toUpperCase() === wanted.toUpperCase());
 }
+function isSelector(step) {
+    if (!isPlainObject(step))
+        return false;
+    const keys = Object.keys(step);
+    return keys.length === 1 && !FORBIDDEN_KEYS.has(keys[0]) && typeof step[keys[0]] === "string" && step[keys[0]] !== "";
+}
+var hasSelector = (at) => Array.isArray(at) && at.some(isSelector);
+function selectAt(root, at) {
+    let node = root;
+    const path = [];
+    for (const step of at) {
+        if (isSelector(step)) {
+            const [[name, wanted]] = Object.entries(step);
+            if (!Array.isArray(node))
+                return { found: false };
+            const hits = [];
+            node.forEach((item, index) => {
+                if (isPlainObject(item) && Object.prototype.hasOwnProperty.call(item, name) && item[name] === wanted)
+                    hits.push(index);
+            });
+            if (hits.length !== 1)
+                return { found: false };
+            path.push(hits[0]);
+            node = node[hits[0]];
+        }
+        else {
+            const next = jsonAt(node, [step]);
+            if (!next.found)
+                return { found: false };
+            path.push(step);
+            node = next.value;
+        }
+    }
+    return { found: true, value: node, path };
+}
+function selectVariants(root, at) {
+    let nodes = [root];
+    for (const step of at) {
+        if (!isSelector(step)) {
+            nodes = nodes.flatMap((node) => valuesIgnoringCase(node, [step]));
+            continue;
+        }
+        const [[name, wanted]] = Object.entries(step);
+        const next = [];
+        for (const node of nodes) {
+            if (!Array.isArray(node))
+                continue;
+            for (const item of node) {
+                if (isPlainObject(item) && Object.keys(item).some((key) => sameName(key, name) && typeof item[key] === "string" && (item[key].toLowerCase() === wanted.toLowerCase() || item[key].toUpperCase() === wanted.toUpperCase())))
+                    next.push(item);
+            }
+        }
+        nodes = next;
+    }
+    return nodes;
+}
+function describeAt(at) {
+    if (!hasSelector(at))
+        return describePath(at);
+    return at.map((step) => isSelector(step) ? `[${Object.keys(step)[0]}=${Object.values(step)[0]}]` : typeof step === "number" ? `[${step}]` : `.${step}`).join("").replace(/^\./, "");
+}
 function jsonReader(parsed) {
-    return { parsed, exact: (at) => jsonAt(parsed, at), variants: (at) => valuesIgnoringCase(parsed, at), label: describePath };
+    return {
+        parsed,
+        exact: (at) => hasSelector(at) ? selectAt(parsed, at) : jsonAt(parsed, at),
+        variants: (at) => hasSelector(at) ? selectVariants(parsed, at) : valuesIgnoringCase(parsed, at),
+        label: describeAt,
+        prefixed: (prefix) => Object.keys(parsed).filter((key) => startsWithIgnoringCase(key, prefix)).map((key) => parsed[key]),
+        scalars: () => jsonScalars(parsed)
+    };
 }
 function fieldReader(fields) {
     return {
@@ -619,9 +3312,27 @@ function fieldReader(fields) {
             return hits.length === 1 ? { found: true, value: hits[0].value, field: hits[0] } : { found: false };
         },
         variants: (at) => fields.filter((field) => sameName(field.name, at)).map((field) => field.value),
-        label: (at) => at
+        label: (at) => at,
+        prefixed: (prefix) => fields.filter((field) => startsWithIgnoringCase(field.name, prefix)).map((field) => field.value),
+        scalars: () => fields.map((field) => field.value)
     };
 }
+function startsWithIgnoringCase(name, prefix) {
+    return !FORBIDDEN_KEYS.has(name) && name.length >= prefix.length && sameName(name.slice(0, prefix.length), prefix);
+}
+function jsonScalars(value, out = [], depth = 0) {
+    if (depth > 64)
+        return out;
+    if (typeof value === "string" || typeof value === "number")
+        out.push(value);
+    else if (Array.isArray(value))
+        for (const item of value)
+            jsonScalars(item, out, depth + 1);
+    else if (isPlainObject(value))
+        for (const key of Object.keys(value))
+            jsonScalars(value[key], out, depth + 1);
+    return out;
+}
 function readBody(p, body, contentType) {
     if (typeof body !== "string")
         return { refusal: "the paused body is not text" };
@@ -630,7 +3341,7 @@ function readBody(p, body, contentType) {
     const typeRefusal = contentTypeRefusal(p, contentType);
     if (typeRefusal)
         return { refusal: typeRefusal };
-    if (p.encoding === "json") {
+    if (jsonBody(p)) {
         let parsed2;
         try {
             parsed2 = JSON.parse(body);
@@ -658,28 +3369,89 @@ var SLOT_NAMES = /* @__PURE__ */ Object.freeze({
     cvv: "the security code",
     exp_month: "the expiry month",
     exp_year: "the expiry year",
+    expiry: "the expiry date",
+    last4: "the card number's last four digits",
+    leading: "the card number's leading digits",
     brand: "the card network code"
 });
+var EXPIRY_FORMATS = /* @__PURE__ */ Object.freeze({
+    mmyy: /^(?:0[1-9]|1[0-2])\d{2}$/,
+    "mm/yy": /^(?:0[1-9]|1[0-2])\/\d{2}$/,
+    "mm/yyyy": /^(?:0[1-9]|1[0-2])\/\d{4}$/,
+    "yyyy-mm": /^\d{4}-(?:0[1-9]|1[0-2])$/,
+    "MM/YY": /^(?:0[1-9]|1[0-2])\/\d{2}$/,
+    "MM-YY": /^(?:0[1-9]|1[0-2])-\d{2}$/,
+    MMYYYY: /^(?:0[1-9]|1[0-2])\d{4}$/
+});
+var AS_TYPED_EXPIRY_FORMATS = /* @__PURE__ */ Object.freeze(["mmyy", "mm/yy", "mm/yyyy", "yyyy-mm"]);
+function expiryForm(spec, value) {
+    if (typeof value !== "string")
+        return null;
+    const forms = spec.format === "as_typed" ? AS_TYPED_EXPIRY_FORMATS : [spec.format];
+    return forms.find((form) => Object.prototype.hasOwnProperty.call(EXPIRY_FORMATS, form) && EXPIRY_FORMATS[form].test(value)) ?? null;
+}
+function expiryText(form, facts) {
+    const mm = String(facts.month).padStart(2, "0");
+    const yy = String(facts.year % 100).padStart(2, "0");
+    if (form === "mmyy")
+        return `${mm}${yy}`;
+    if (form === "mm/yy" || form === "MM/YY")
+        return `${mm}/${yy}`;
+    if (form === "MM-YY")
+        return `${mm}-${yy}`;
+    if (form === "mm/yyyy")
+        return `${mm}/${facts.year}`;
+    if (form === "MMYYYY")
+        return `${mm}${facts.year}`;
+    return `${facts.year}-${mm}`;
+}
 function cardSlots(p) {
+    const c = p.card;
+    const expiry = c.expiry ? [["expiry", c.expiry]] : [["exp_month", c.exp_month], ["exp_year", c.exp_year]];
     return [
-        ["pan", p.card.pan],
-        ["cvv", p.card.cvv],
-        ["exp_month", p.card.exp_month],
-        ["exp_year", p.card.exp_year],
-        ...p.card.brands.map((brand) => ["brand", brand])
-    ];
-}
-function placeholderFits(slot, spec, value) {
+        ["pan", c.pan],
+        ["cvv", c.cvv],
+        ...expiry,
+        ["last4", c.last4],
+        ["leading", c.leading],
+        ...c.brands.map((brand) => ["brand", brand])
+    ].filter(([, spec]) => spec);
+}
+function codeNotAsked(reader, spec, variants) {
+    if (spec.format !== "digits_if_asked")
+        return false;
+    if (variants.length === 0)
+        return true;
+    const at = reader.exact(spec.at);
+    return variants.length === 1 && at.found && at.value === "";
+}
+function groupedFour(digits) {
+    return digits.replace(/(.{4})/g, "$1 ").trim();
+}
+function panDigits(spec, value) {
+    return spec.format === "grouped4" && typeof value === "string" ? value.replace(/ /g, "") : value;
+}
+function placeholderFits(p, slot, spec, value) {
+    if (spec.format === "encrypted")
+        return encryptedValueFits(p.merchant_key, value);
     const text = typeof value === "string";
     const int = Number.isInteger(value);
     switch (slot) {
-        case "pan":
-            return text && /^\d{12,19}$/.test(value);
+        case "leading":
+            return text && value.length === spec.digits && /^\d+$/.test(value);
+        case "pan": {
+            if (!text)
+                return false;
+            const digits = panDigits(spec, value);
+            return /^\d{12,19}$/.test(digits) && (digits === value || value === groupedFour(digits));
+        }
         case "cvv":
             return text && /^\d{3,4}$/.test(value);
         case "exp_month":
             if (spec.format === "mm")
                 return text && /^(?:0[1-9]|1[0-2])$/.test(value);
+            if (spec.format === "m")
+                return text && /^(?:[1-9]|1[0-2])$/.test(value);
             if (spec.format === "m_int")
                 return int && value >= 1 && value <= 12;
             return spec.format === "as_typed" && (text && /^(?:0?[1-9]|1[0-2])$/.test(value) || int && value >= 1 && value <= 12);
@@ -688,50 +3460,102 @@ function placeholderFits(slot, spec, value) {
                 return text && /^\d{4}$/.test(value);
             if (spec.format === "yyyy_int")
                 return int && value >= 1e3 && value <= 9999;
+            if (spec.format === "yy_int")
+                return int && value >= 0 && value <= 99;
             return spec.format === "as_typed" && (text && /^(?:\d{2}|\d{4})$/.test(value) || int && (value >= 0 && value <= 99 || value >= 1e3 && value <= 9999));
+        case "expiry":
+            return expiryForm(spec, value) !== null;
+        case "last4":
+            return text && /^\d{4}$/.test(value);
         case "brand":
             return spec.map ? Object.values(spec.map).includes(value) : text && value !== "";
         default:
             return false;
     }
 }
+var DECIMAL_AMOUNT = /^\d{1,9}(?:\.\d{1,2})?$/;
 function isNothing(value) {
     return value === null || value === "" || Array.isArray(value) && value.length === 0 || isPlainObject(value) && Object.keys(value).length === 0;
 }
+function clearCardNumber(texts) {
+    for (const text of texts) {
+        for (const [run] of text.matchAll(/[0-9](?:[ -]?[0-9])*/g)) {
+            const digits = run.replace(/[ -]/g, "");
+            if (digits.length < 13 || digits.length > 19 || !/^[2-6]/.test(digits))
+                continue;
+            let sum = 0;
+            for (let i = 0; i < digits.length; i += 1) {
+                let digit = Number(digits[digits.length - 1 - i]);
+                if (i % 2 === 1)
+                    digit = digit * 2 > 9 ? digit * 2 - 9 : digit * 2;
+                sum += digit;
+            }
+            if (sum % 10 === 0)
+                return digits;
+        }
+    }
+    return null;
+}
+var bodyTexts = (reader, body) => [body, ...reader.fields ? reader.fields.map((field) => field.value) : []];
+var pinnedKids = (merchantKey) => merchantKey.keys.map((key) => key.kid);
 function rulesRefusal(p, reader, body) {
     const request = `the paused body is not ${p.merchant}'s card request`;
     for (const [slot, spec] of cardSlots(p)) {
         const label = reader.label(spec.at);
-        const once = onlyOnce(reader.variants(spec.at).length, label);
+        const variants = reader.variants(spec.at);
+        if (slot === "cvv" && codeNotAsked(reader, spec, variants))
+            continue;
+        const once = onlyOnce(variants.length, label);
         if (once)
             return `${request}: ${once}`;
         const at = reader.exact(spec.at);
         if (!at.found)
             return `${request}: ${label} is not spelled as reviewed`;
-        if (!placeholderFits(slot, spec, at.value))
+        if (!placeholderFits(p, slot, spec, at.value))
             return `${request}: ${label} is not ${SLOT_NAMES[slot]} in the reviewed form`;
     }
-    if (countRuns(body, reader.exact(p.card.pan.at).value) !== 1) {
-        return `${request}: the card number appears outside ${reader.label(p.card.pan.at)}`;
+    const merchantKey = p.merchant_key;
+    if (merchantKey && merchantKey.scheme === "rsa_oaep" && merchantKey.kid_at) {
+        const label = reader.label(merchantKey.kid_at);
+        const once = onlyOnce(reader.variants(merchantKey.kid_at).length, label);
+        if (once)
+            return `${request}: ${once}`;
+        const at = reader.exact(merchantKey.kid_at);
+        const kids = pinnedKids(merchantKey);
+        if (!at.found || typeof at.value !== "string" || at.value === "" || kids.length > 0 && !kids.includes(at.value)) {
+            return `${request}: ${label} does not name a key Agentcard pinned for ${p.merchant}`;
+        }
+    }
+    const typed = p.card.pan && ["digits", "grouped4"].includes(p.card.pan.format) ? panDigits(p.card.pan, reader.exact(p.card.pan.at).value) : null;
+    if (typed !== null) {
+        if (countRuns(body, typed) !== 1) {
+            return `${request}: the card number appears outside ${reader.label(p.card.pan.at)}`;
+        }
+    }
+    else if (clearCardNumber(bodyTexts(reader, body)) !== null) {
+        return `${request}: a card number appears in the clear`;
+    }
+    if (p.card.last4 && (typed === null || reader.exact(p.card.last4.at).value !== typed.slice(-4))) {
+        return `${request}: ${reader.label(p.card.last4.at)} is not the last four digits of ${p.card.pan ? reader.label(p.card.pan.at) : SLOT_NAMES.pan}`;
     }
     for (const rule of p.requires) {
         const label = reader.label(rule.at);
         const variants = reader.variants(rule.at);
         const at = reader.exact(rule.at);
-        const holds = (value) => "equals" in rule ? value === rule.equals : "one_of" in rule ? rule.one_of.includes(value) : !isNothing(value);
+        const holds = (value) => "equals" in rule ? value === rule.equals : "one_of" in rule ? rule.one_of.includes(value) : "matches" in rule ? typeof value === "string" && Object.prototype.hasOwnProperty.call(SHAPES, rule.matches) && SHAPES[rule.matches].test(value) : !isNothing(value);
         if (!at.found || variants.length !== 1 || !holds(at.value))
             return `${request}: ${label} is not what the review requires`;
     }
     for (const rule of p.refuse) {
-        const values = reader.variants(rule.at);
-        const fires = rule.when === "present" ? values.length > 0 : rule.when === "nonempty" ? values.some((value) => !isNothing(value)) : p.encoding === "json" ? values.some((value) => value !== false && value !== null) : values.some((value) => value !== "" && value !== "false");
+        const values = "prefix" in rule ? reader.prefixed(rule.prefix) : reader.variants(rule.at);
+        const fires = rule.when === "present" ? values.length > 0 : rule.when === "nonempty" ? values.some((value) => !isNothing(value)) : jsonBody(p) ? values.some((value) => value !== false && value !== null) : values.some((value) => value !== "" && value !== "false");
         if (fires)
-            return `the paused body asks ${p.merchant} for more than this purchase: ${reader.label(rule.at)}`;
+            return `the paused body asks ${p.merchant} for more than this purchase: ${"prefix" in rule ? `a field starting ${rule.prefix}` : reader.label(rule.at)}`;
     }
     if (p.amount) {
         const label = reader.label(p.amount.at);
         const at = reader.exact(p.amount.at);
-        const fits = p.amount.kind === "decimal_string" ? typeof at.value === "string" && /^\d{1,9}(?:\.\d{1,2})?$/.test(at.value) : p.encoding === "json" ? Number.isSafeInteger(at.value) && at.value >= 0 : typeof at.value === "string" && /^\d{1,12}$/.test(at.value);
+        const fits = p.amount.kind === "decimal_string" ? typeof at.value === "string" && DECIMAL_AMOUNT.test(at.value) : p.amount.kind === "decimal_number" ? jsonBody(p) && typeof at.value === "number" && DECIMAL_AMOUNT.test(String(at.value)) : jsonBody(p) ? Number.isSafeInteger(at.value) && at.value >= 0 : typeof at.value === "string" && /^\d{1,12}$/.test(at.value);
         if (!at.found || reader.variants(p.amount.at).length !== 1 || !fits)
             return `${request}: the amount at ${label} is not a ${p.amount.kind.replace("_", " ")}`;
     }
@@ -748,7 +3572,29 @@ function merchantCardEndpointBodyRefusal(profile, body, contentType) {
     const read = readBody(p, body, contentType);
     return read.refusal ?? rulesRefusal(p, read.reader, body);
 }
-var TWO_DECIMAL_CURRENCIES = /* @__PURE__ */ new Set(["usd", "eur", "gbp", "cad", "aud"]);
+function merchantCardEndpointPasses(profile, body, contentType) {
+    const p = trustedMerchantCardEndpoint(profile);
+    if (!p.payment_method)
+        return false;
+    const read = readBody(p, body, contentType);
+    if (read.refusal)
+        return false;
+    const at = read.reader.exact(p.payment_method.at);
+    if (read.reader.variants(p.payment_method.at).length !== 1 || !at.found || typeof at.value !== "string" || at.value === "")
+        return false;
+    const method = at.value.toLowerCase();
+    return !p.payment_method.card.some((value) => value.toLowerCase() === method);
+}
+function merchantCardEndpointSessionTtl(profile, body, contentType) {
+    const p = trustedMerchantCardEndpoint(profile);
+    const read = readBody(p, body, contentType);
+    const refusal = read.refusal ?? rulesRefusal(p, read.reader, body);
+    if (refusal)
+        throw new Error(`Refusing to pay: ${refusal}.`);
+    if (!p.challenge)
+        return null;
+    return read.reader.variants(p.challenge.at).some((value) => !isNothing(value)) ? p.challenge.ttl_ms : null;
+}
 function merchantCardEndpointAmount(profile, body, contentType) {
     const p = trustedMerchantCardEndpoint(profile);
     const read = readBody(p, body, contentType);
@@ -763,9 +3609,91 @@ function merchantCardEndpointAmount(profile, body, contentType) {
         return { amountCents: Number(value), currency };
     if (!TWO_DECIMAL_CURRENCIES.has(currency))
         throw new Error(`Refusing to pay: ${p.merchant}'s amount is in a currency this build does not read.`);
-    const [whole, fraction = ""] = value.split(".");
+    const [whole, fraction = ""] = String(value).split(".");
     return { amountCents: Number(whole) * 100 + Number(fraction.padEnd(2, "0")), currency };
 }
+var WRITTEN_DIGIT = String.raw `(?:[0-9]|\\u003[0-9]|%3[0-9]|&#0*(?:4[89]|5[0-7]);|&#x0*3[0-9];)`;
+var WRITTEN_RUN = /* @__PURE__ */ new RegExp(`${WRITTEN_DIGIT}+(?:${SEPARATOR}+${WRITTEN_DIGIT}+)*`, "gi");
+var RUN_TOKEN = /* @__PURE__ */ new RegExp(`(${WRITTEN_DIGIT})|${SEPARATOR}`, "giy");
+function writtenDigit(token) {
+    if (token.length === 1)
+        return token;
+    if (/^&#[0-9]/.test(token))
+        return String.fromCharCode(Number(token.slice(2, -1)));
+    return token.endsWith(";") ? token[token.length - 2] : token[token.length - 1];
+}
+function luhnValid(digits) {
+    let sum = 0;
+    for (let i = 0; i < digits.length; i += 1) {
+        let digit = digits.charCodeAt(digits.length - 1 - i) - 48;
+        if (i % 2 === 1) {
+            digit *= 2;
+            if (digit > 9)
+                digit -= 9;
+        }
+        sum += digit;
+    }
+    return sum % 10 === 0;
+}
+function writesCardNumber(text) {
+    for (const [run] of text.matchAll(WRITTEN_RUN)) {
+        const groups = [];
+        let group = "";
+        for (const token of run.matchAll(RUN_TOKEN)) {
+            if (token[1] !== void 0)
+                group += writtenDigit(token[1]);
+            else if (group !== "") {
+                groups.push(group);
+                group = "";
+            }
+        }
+        if (group !== "")
+            groups.push(group);
+        for (let first = 0; first < groups.length; first += 1) {
+            let digits = "";
+            for (let last = first; last < groups.length && digits.length + groups[last].length <= 19; last += 1) {
+                digits += groups[last];
+                if (digits.length >= 12 && luhnValid(digits))
+                    return true;
+            }
+        }
+    }
+    return false;
+}
+function cardNumberValues(p, body, contentType) {
+    const at = (p.card.pan ?? p.card.cvv).at;
+    if (jsonBody(p)) {
+        let parsed2;
+        try {
+            parsed2 = JSON.parse(body);
+        }
+        catch {
+            return [];
+        }
+        if (!isPlainObject(parsed2))
+            return [];
+        return hasSelector(at) ? selectVariants(parsed2, at) : valuesIgnoringCase(parsed2, at);
+    }
+    const parsed = p.encoding === "form" ? parseForm(body) : parseMultipart(body, multipartBoundary(contentType));
+    return parsed.refusal ? [] : parsed.fields.filter((field) => sameName(field.name, at)).map((field) => field.value);
+}
+function navigationPostCarriesCard(p, body, contentType) {
+    const read = readBody(p, body, contentType);
+    if (read.refusal)
+        return true;
+    const { reader } = read;
+    if ([p.card.pan, p.card.cvv].some((spec) => spec && reader.variants(spec.at).some((value) => !isNothing(value))))
+        return true;
+    return reader.scalars().some((value) => (String(value).replace(/[\s.-]/g, "").match(/\d+/g) ?? []).some((run) => run.length >= 12 && run.length <= 19 && luhnValid(run)));
+}
+function merchantCardEndpointCarriesCard(profile, body, contentType) {
+    const p = trustedMerchantCardEndpoint(profile);
+    if (typeof body !== "string" || body === "" || utf8Length(body) > MERCHANT_CARD_ENDPOINT_LIMITS.bodyBytes)
+        return true;
+    if (cardNumberValues(p, body, contentType).some((value) => !isNothing(value)) || writesCardNumber(body))
+        return true;
+    return p.navigation !== null && navigationPostCarriesCard(p, body, contentType);
+}
 function endpointMatches(p, rawUrl, method, opts) {
     if (typeof rawUrl !== "string" || rawUrl.length > MERCHANT_CARD_ENDPOINT_LIMITS.urlLength)
         return false;
@@ -797,6 +3725,14 @@ function merchantCardEndpointMatches(profile, rawUrl, method, opts) {
 function matchMerchantCardEndpoint(rawUrl, method, opts) {
     return MERCHANT_CARD_ENDPOINT_CLIENT_TABLE.find((p) => endpointMatches(p, rawUrl, method, opts)) ?? null;
 }
+function matchMerchantCardEndpointResend(rawUrl, method) {
+    if (typeof rawUrl !== "string" || rawUrl.length > MERCHANT_CARD_ENDPOINT_LIMITS.urlLength || typeof method !== "string")
+        return null;
+    const url = strictUrl(rawUrl);
+    if (!url)
+        return null;
+    return MERCHANT_CARD_ENDPOINT_CLIENT_TABLE.find((p) => url.origin === p.endpoint && (p.resends ?? []).some((resend) => resend.method === method.toUpperCase() && urlTemplateMatch(resend, rawUrl) !== null)) ?? null;
+}
 function assertMerchantCardEndpoint(authorization) {
     if (!isPlainObject(authorization))
         throw new Error("Refusing to pay: malformed payment endpoint.");
@@ -838,7 +3774,7 @@ function refererKept(p, referer) {
     catch {
         return false;
     }
-    return url.href === referer && url.origin === p.checkout && !url.username && !url.password;
+    return url.href === referer && url.origin === (p.frame ?? p.checkout) && !url.username && !url.password;
 }
 function lowerHeaders(headers) {
     const out = /* @__PURE__ */ Object.create(null);
@@ -850,6 +3786,55 @@ function lowerHeaders(headers) {
     }
     return out;
 }
+function cookieNameAllowed(p, name) {
+    const names = p.session.cookie_names;
+    if (names === null)
+        return true;
+    return names.some((entry) => entry.endsWith("*") ? name.startsWith(entry.slice(0, -1)) && name.length > entry.length - 1 : name === entry);
+}
+function sessionCookie(bundle, name) {
+    const hits = (Array.isArray(bundle.cookies) ? bundle.cookies : []).filter((cookie) => cookie.name === name);
+    return hits.length === 1 ? hits[0].value : null;
+}
+function checkoutKeyOf(p, bundle, reader) {
+    const once = p.once_per;
+    if (!once)
+        return null;
+    let value = null;
+    if ("at" in once) {
+        const at = reader.exact(once.at);
+        value = at.found && reader.variants(once.at).length === 1 ? at.value : null;
+    }
+    else if ("path" in once) {
+        value = pathPlaceholders(p.path, new URL(bundle.url).pathname)?.[once.path] ?? null;
+    }
+    else if ("query" in once) {
+        const mark = bundle.url.indexOf("?");
+        value = queryPlaceholders(p.query, mark === -1 ? null : bundle.url.slice(mark + 1))?.[once.query] ?? null;
+    }
+    else if ("cookie" in once) {
+        value = sessionCookie(bundle, once.cookie);
+    }
+    return typeof value === "string" && value !== "" ? value : null;
+}
+function sessionBindingRefusal(p, bundle, contentType) {
+    const { reader } = readBody(p, bundle.body, contentType);
+    for (const rule of p.requires) {
+        if ("equals_cookie" in rule) {
+            const cookie = sessionCookie(bundle, rule.equals_cookie);
+            if (cookie === null || reader.exact(rule.at).value !== cookie)
+                return `${reader.label(rule.at)} is not the checkout the session's ${rule.equals_cookie} cookie names`;
+        }
+        if ("equals_path" in rule) {
+            const segment = pathPlaceholders(p.path, new URL(bundle.url).pathname)?.[rule.equals_path];
+            if (segment === void 0 || reader.exact(rule.at).value !== segment)
+                return `${reader.label(rule.at)} is not the checkout the card request's URL names`;
+        }
+    }
+    if (p.once_per && checkoutKeyOf(p, bundle, reader) === null)
+        return `the session names no checkout for ${p.merchant} to take one payment from`;
+    return null;
+}
 function merchantCardEndpointSessionRefusal(profile, bundle) {
     const p = trustedMerchantCardEndpoint(profile);
     const limits = MERCHANT_CARD_ENDPOINT_LIMITS;
@@ -861,6 +3846,9 @@ function merchantCardEndpointSessionRefusal(profile, bundle) {
         return `the session bundle's URL is not ${p.merchant}'s reviewed card endpoint`;
     if (bundle.page_origin !== p.checkout)
         return `the card request was not paused on ${p.checkout}`;
+    if (p.navigation === null ? bundle.navigation !== void 0 : bundle.navigation !== p.navigation) {
+        return p.navigation === null ? `${p.merchant}'s card request is not a page navigation` : `the card request was not the ${p.navigation === "top" ? "page" : "frame"} navigation ${p.merchant}'s form sends`;
+    }
     const raw = bundle.headers === void 0 ? {} : bundle.headers;
     const headers = isPlainObject(raw) ? lowerHeaders(raw) : null;
     if (!headers)
@@ -892,51 +3880,83 @@ function merchantCardEndpointSessionRefusal(profile, bundle) {
             return "a session cookie is not an RFC 6265 name and value";
         if (cookie.name.length + cookie.value.length + 1 > limits.headerValueBytes)
             return "a session cookie is larger than the limit";
+        if (!cookieNameAllowed(p, cookie.name))
+            return `the session bundle carries a cookie outside ${p.merchant}'s reviewed list`;
         cookieBytes += cookie.name.length + cookie.value.length + 3;
     }
     if (cookieBytes > limits.headerBytes)
         return "the session cookies are larger than the limit";
     if (bundle.referer !== void 0 && !refererKept(p, bundle.referer))
-        return `the session Referer is not a page on ${p.checkout}`;
-    return merchantCardEndpointBodyRefusal(p.id, bundle.body, headers["content-type"]);
+        return `the session Referer is not a page on ${p.frame ?? p.checkout}`;
+    return merchantCardEndpointBodyRefusal(p.id, bundle.body, headers["content-type"]) ?? sessionBindingRefusal(p, bundle, headers["content-type"]);
+}
+function merchantCardEndpointCheckoutKey(profile, bundle) {
+    const p = trustedMerchantCardEndpoint(profile);
+    const refusal = merchantCardEndpointSessionRefusal(p.id, bundle);
+    if (refusal)
+        throw new Error(`Refusing to pay: ${refusal}.`);
+    const headers = lowerHeaders(bundle.headers ?? {});
+    return checkoutKeyOf(p, bundle, readBody(p, bundle.body, headers["content-type"]).reader);
 }
 function slotValue(slot, spec, placeholder, facts) {
     if (slot === "pan")
-        return facts.number;
+        return spec.format === "grouped4" && placeholder.includes(" ") ? groupedFour(facts.number) : facts.number;
     if (slot === "cvv")
         return facts.cvc;
+    if (slot === "last4")
+        return facts.number.slice(-4);
+    if (slot === "expiry")
+        return expiryText(expiryForm(spec, placeholder), facts);
+    if (slot === "leading")
+        return facts.number.slice(0, spec.digits);
+    const month = String(facts.month).padStart(2, "0");
     if (slot === "exp_month") {
-        const padded = String(facts.month).padStart(2, "0");
         if (spec.format === "mm")
-            return padded;
+            return month;
+        if (spec.format === "m")
+            return String(facts.month);
         if (spec.format === "m_int" || typeof placeholder === "number")
             return facts.month;
-        return placeholder.length === 2 ? padded : String(facts.month);
+        return placeholder.length === 2 ? month : String(facts.month);
     }
     if (spec.format === "yyyy")
         return String(facts.year);
     if (spec.format === "yyyy_int")
         return facts.year;
+    if (spec.format === "yy_int")
+        return facts.year % 100;
     if (typeof placeholder === "number")
         return placeholder >= 1e3 ? facts.year : facts.year % 100;
     return placeholder.length === 4 ? String(facts.year) : String(facts.year % 100).padStart(2, "0");
 }
+function plaintextFor(slot, spec, facts) {
+    if (spec.plaintext === "digits")
+        return slot === "cvv" ? facts.cvc : facts.number;
+    if (spec.plaintext === "MMYYYY")
+        return `${String(facts.month).padStart(2, "0")}${facts.year}`;
+    let claims = facts.number;
+    for (const name of [...spec.plaintext.claims].reverse())
+        claims = { [name]: claims };
+    return JSON.stringify(claims);
+}
 function writeJson(parsed, at, value) {
-    const parent = jsonAt(parsed, at.slice(0, -1));
-    const key = at[at.length - 1];
+    const path = hasSelector(at) ? selectAt(parsed, at).path : at;
+    if (!path)
+        throw new SubstitutionError(`the paused body has no field at ${describeAt(at)}`);
+    const parent = jsonAt(parsed, path.slice(0, -1));
+    const key = path[path.length - 1];
     const owned = parent.found && (typeof key === "number" ? Array.isArray(parent.value) && key < parent.value.length : isPlainObject(parent.value) && !FORBIDDEN_KEYS.has(key) && Object.prototype.hasOwnProperty.call(parent.value, key));
     if (!owned)
-        throw new SubstitutionError(`the paused body has no field at ${describePath(at)}`);
+        throw new SubstitutionError(`the paused body has no field at ${describeAt(at)}`);
     parent.value[key] = value;
 }
-function substituteMerchantCardEndpoint(body, contentType, profile, card) {
-    const p = trustedMerchantCardEndpoint(profile);
+function substitutionPlan(p, body, contentType, card) {
     const read = readBody(p, body, contentType);
     const refusal = read.refusal ?? rulesRefusal(p, read.reader, body);
     if (refusal)
         throw new SubstitutionError(refusal);
     const facts = cardFacts(card);
-    const typed = read.reader.exact(p.card.pan.at).value;
+    const typed = p.card.pan && ["digits", "grouped4"].includes(p.card.pan.format) ? panDigits(p.card.pan, read.reader.exact(p.card.pan.at).value) : null;
     if (typed === facts.number)
         throw new SubstitutionError("the paused body already carries the real card number");
     const bins = p.card.bins && facts.brand && Object.prototype.hasOwnProperty.call(p.card.bins, facts.brand) ? p.card.bins[facts.brand] : null;
@@ -947,56 +3967,155 @@ function substituteMerchantCardEndpoint(body, contentType, profile, card) {
         const at = read.reader.exact(spec.at);
         if (slot === "brand" && !spec.map)
             continue;
-        let value;
+        if (slot === "cvv" && codeNotAsked(read.reader, spec, read.reader.variants(spec.at)))
+            continue;
         if (slot === "brand") {
-            value = facts.brand && Object.prototype.hasOwnProperty.call(spec.map, facts.brand) ? spec.map[facts.brand] : void 0;
+            const value = facts.brand && Object.prototype.hasOwnProperty.call(spec.map, facts.brand) ? spec.map[facts.brand] : void 0;
             if (value === void 0)
                 throw new SubstitutionError(`${p.merchant} does not take this card's network`);
+            writes.push({ at: spec.at, found: at, value });
+        }
+        else if (spec.format === "encrypted") {
+            writes.push({ at: spec.at, found: at, value: null, plaintext: plaintextFor(slot, spec, facts) });
         }
         else {
-            value = slotValue(slot, spec, at.value, facts);
+            writes.push({ at: spec.at, found: at, value: slotValue(slot, spec, at.value, facts) });
         }
-        writes.push({ at: spec.at, found: at, value });
+    }
+    return { read, facts, typed, writes };
+}
+function writtenBody(p, plan, body) {
+    if (jsonBody(p)) {
+        for (const write of plan.writes)
+            writeJson(plan.read.reader.parsed, write.at, write.value);
+        return JSON.stringify(plan.read.reader.parsed);
     }
     let out = body;
-    if (p.encoding === "json") {
-        for (const write of writes)
-            writeJson(read.reader.parsed, write.at, write.value);
-        out = JSON.stringify(read.reader.parsed);
-    }
-    else {
-        for (const write of [...writes].sort((a, b) => b.found.field.start - a.found.field.start)) {
-            const text = p.encoding === "form" ? encodeURIComponent(String(write.value)).replace(/%20/g, "+") : String(write.value);
-            out = out.slice(0, write.found.field.start) + text + out.slice(write.found.field.end);
-        }
+    for (const write of [...plan.writes].sort((a, b) => b.found.field.start - a.found.field.start)) {
+        const text = p.encoding === "form" ? encodeURIComponent(String(write.value)).replace(/%20/g, "+") : String(write.value);
+        out = out.slice(0, write.found.field.start) + text + out.slice(write.found.field.end);
     }
-    if (countRuns(out, typed) !== 0)
+    return out;
+}
+function merchantCardEndpointEncrypts(profile) {
+    return trustedMerchantCardEndpoint(profile).merchant_key != null;
+}
+function substituteMerchantCardEndpoint(body, contentType, profile, card) {
+    const p = trustedMerchantCardEndpoint(profile);
+    if (p.merchant_key)
+        throw new SubstitutionError(`${p.merchant} takes the card encrypted under its own key, which this call does not write`);
+    const plan = substitutionPlan(p, body, contentType, card);
+    const out = writtenBody(p, plan, body);
+    if (countRuns(out, plan.typed) !== 0)
         throw new SubstitutionError("the typed card number would still reach the merchant");
-    if (countRuns(out, facts.number) !== 1)
+    if (countRuns(out, plan.facts.number) !== 1)
         throw new SubstitutionError("the card number would reach the merchant outside its field");
     if (!merchantCardEndpointLive(p))
         throw new SubstitutionError(`Agentcard has not turned on payments to ${p.merchant} yet`);
     return out;
 }
-function merchantEndpointRequest(profile, bundle, card) {
+function merchantKeyFor(p, plan) {
+    const merchantKey = p.merchant_key;
+    const encrypted = cardSlots(p).filter(([, spec]) => spec.format === "encrypted").map(([, spec]) => plan.read.reader.exact(spec.at).value);
+    let key = null;
+    if (merchantKey.scheme === "rsa_oaep") {
+        if (merchantKey.kid_at) {
+            const kid = plan.read.reader.exact(merchantKey.kid_at).value;
+            key = merchantKey.keys.find((entry) => entry.kid === kid) ?? null;
+        }
+        else if (merchantKey.keys.length === 1) {
+            key = merchantKey.keys[0];
+        }
+    }
+    else if (merchantKey.alg !== null) {
+        const kids = new Set(encrypted.map((value) => readCompactJwe(value)?.header.kid));
+        const [kid] = kids;
+        key = kids.size === 1 ? merchantKey.keys.find((entry) => entry.kid === kid) ?? null : null;
+    }
+    if (!key)
+        throw new SubstitutionError(`Agentcard has not pinned the key ${p.merchant} encrypts the card under`);
+    let size;
+    try {
+        ({ size } = parseMerchantKey(key));
+    }
+    catch {
+        throw new SubstitutionError(`the key Agentcard pinned for ${p.merchant} does not match its pin`);
+    }
+    const sizes = encrypted.map((value) => merchantKey.scheme === "rsa_oaep" ? decodeBase64(value)?.length : readCompactJwe(value)?.encryptedKey.length);
+    if (sizes.some((length) => length !== size))
+        throw new SubstitutionError(`the paused body was encrypted under a key Agentcard did not pin for ${p.merchant}`);
+    return key;
+}
+async function encryptedValue(merchantKey, key, text, crypto) {
+    const bytes = new TextEncoder().encode(text);
+    try {
+        if (merchantKey.scheme === "rsa_oaep") {
+            return encodeBase64(await rsaOaepEncrypt(key, bytes, { hash: merchantKey.hash, mgf1: merchantKey.mgf1 }, crypto));
+        }
+        return await jweCompactEncrypt(key, bytes, merchantKey, key.kid, crypto);
+    }
+    catch (error) {
+        if (error instanceof MerchantKeyError)
+            throw new SubstitutionError(`the card could not be encrypted under ${error.reason === "key" ? "the pinned key" : "this device"}`);
+        throw error;
+    }
+    finally {
+        bytes.fill(0);
+    }
+}
+async function encryptMerchantCardEndpointBody(body, contentType, profile, card, crypto) {
     const p = trustedMerchantCardEndpoint(profile);
-    const refusal = merchantCardEndpointSessionRefusal(p.id, bundle);
-    if (refusal)
-        throw new Error(`Refusing to pay: ${refusal}.`);
-    const captured = lowerHeaders(bundle.headers ?? {});
-    const body = substituteMerchantCardEndpoint(bundle.body, captured["content-type"], p.id, card);
-    const headers = { "content-type": p.encoding === "form" ? "application/x-www-form-urlencoded; charset=UTF-8" : captured["content-type"] };
+    if (!p.merchant_key)
+        throw new SubstitutionError(`${p.merchant} takes the card in the clear, which this call does not write`);
+    const plan = substitutionPlan(p, body, contentType, card);
+    const key = merchantKeyFor(p, plan);
+    for (const write of plan.writes) {
+        if (write.plaintext === void 0)
+            continue;
+        write.value = await encryptedValue(p.merchant_key, key, write.plaintext, crypto);
+        write.plaintext = void 0;
+    }
+    const out = writtenBody(p, plan, body);
+    if (countRuns(out, plan.facts.number) !== 0 || clearCardNumber([out]) !== null)
+        throw new SubstitutionError("a card number would reach the merchant in the clear");
+    if (!merchantCardEndpointLive(p))
+        throw new SubstitutionError(`Agentcard has not turned on payments to ${p.merchant} yet`);
+    return out;
+}
+function endpointRequest(p, bundle, captured, body) {
+    const formType = p.navigation === null ? "application/x-www-form-urlencoded; charset=UTF-8" : NAVIGATION_FORM_TYPE;
+    const headers = { "content-type": p.encoding === "form" ? formType : captured["content-type"] };
     for (const [name, value] of Object.entries(captured))
         if (name !== "content-type")
             headers[name] = value;
     const cookies = bundle.cookies ?? [];
     if (p.session.cookies && cookies.length > 0)
         headers.cookie = cookies.map((cookie) => `${cookie.name}=${cookie.value}`).join("; ");
-    headers.origin = p.checkout;
+    headers.origin = p.frame ?? p.checkout;
     if (bundle.referer !== void 0)
         headers.referer = bundle.referer;
     return { url: bundle.url, method: p.method, headers, body };
 }
+function merchantEndpointRequest(profile, bundle, card) {
+    const p = trustedMerchantCardEndpoint(profile);
+    if (p.merchant_key)
+        throw new Error(`Refusing to pay: ${p.merchant} takes the card encrypted under its own key, which this call does not write.`);
+    const refusal = merchantCardEndpointSessionRefusal(p.id, bundle);
+    if (refusal)
+        throw new Error(`Refusing to pay: ${refusal}.`);
+    const captured = lowerHeaders(bundle.headers ?? {});
+    return endpointRequest(p, bundle, captured, substituteMerchantCardEndpoint(bundle.body, captured["content-type"], p.id, card));
+}
+async function encryptedMerchantEndpointRequest(profile, bundle, card, crypto) {
+    const p = trustedMerchantCardEndpoint(profile);
+    if (!p.merchant_key)
+        throw new Error(`Refusing to pay: ${p.merchant} takes the card in the clear, which this call does not write.`);
+    const refusal = merchantCardEndpointSessionRefusal(p.id, bundle);
+    if (refusal)
+        throw new Error(`Refusing to pay: ${refusal}.`);
+    const captured = lowerHeaders(bundle.headers ?? {});
+    return endpointRequest(p, bundle, captured, await encryptMerchantCardEndpointBody(bundle.body, captured["content-type"], p.id, card, crypto));
+}
 function headerPairs(headers) {
     if (headers === void 0)
         return [];
@@ -1026,7 +4145,7 @@ var BASE64_RUN = /[A-Za-z0-9+/_-]{8,}/g;
 var STREAM_RUN_LENGTH = 16;
 var CODE_BASE64_RUN = /[A-Za-z0-9+/_-]{4,}/g;
 var BASE64_ESCAPE = /\\\/|\\u002[bBfF]|%2[bBfF]|&#(?:43|47|x2[bBfF]);/g;
-var BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+var BASE64_ALPHABET2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 var unescapeBase64 = (escape) => /43|[bB]/.test(escape) ? "+" : "/";
 function base64Bytes(run, skip) {
     let bits = 0;
@@ -1034,7 +4153,7 @@ function base64Bytes(run, skip) {
     let out = "";
     for (let i = skip; i < run.length; i += 1) {
         const char = run[i];
-        value = value << 6 | (char === "-" ? 62 : char === "_" ? 63 : BASE64_ALPHABET.indexOf(char));
+        value = value << 6 | (char === "-" ? 62 : char === "_" ? 63 : BASE64_ALPHABET2.indexOf(char));
         bits += 6;
         if (bits >= 8) {
             bits -= 8;
@@ -1081,10 +4200,27 @@ function responseCardLeak(card, response) {
     }
     return seen.compressed ? "unreadable_in_response" : null;
 }
+var JSON_PROTECTION_PREFIX = /^\)\]\}',?\n/;
+function merchantCardEndpointAnswerRefusal(profile, bodyText) {
+    const p = trustedMerchantCardEndpoint(profile);
+    const rules = p.response.withhold ?? [];
+    if (rules.length === 0 || typeof bodyText !== "string")
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(bodyText.replace(JSON_PROTECTION_PREFIX, ""));
+    }
+    catch {
+        return null;
+    }
+    if (!isPlainObject(parsed))
+        return null;
+    return rules.some((rule) => valuesIgnoringCase(parsed, rule.at).some((value) => value === rule.equals)) ? "refused_step_in_response" : null;
+}
 function merchantCardEndpointAnswer(profile, response, card) {
     const p = trustedMerchantCardEndpoint(profile);
     const pairs = answerParts(response);
-    const withheld = responseCardLeak(card, response);
+    const withheld = responseCardLeak(card, response) ?? merchantCardEndpointAnswerRefusal(p.id, response.bodyText);
     if (withheld)
         return { status: response.status, withheld, headers: {}, set_cookies: [], bodyText: null };
     const headers = {};
@@ -1100,4 +4236,26 @@ function merchantCardEndpointAnswer(profile, response, card) {
     }
     return { status: response.status, headers, set_cookies: setCookies, bodyText: response.bodyText };
 }
-export { MERCHANT_CARD_ENDPOINT_CLIENT_TABLE, MERCHANT_CARD_ENDPOINT_LIMITS, MERCHANT_CARD_ENDPOINT_MODE, MERCHANT_CARD_ENDPOINT_PROFILES, MERCHANT_CARD_ENDPOINT_PSP, MERCHANT_CARD_ENDPOINT_RECOGNIZERS, SubstitutionError, assertMerchantCardEndpoint, matchMerchantCardEndpoint, merchantCardEndpointAmount, merchantCardEndpointAnswer, merchantCardEndpointBodyRefusal, merchantCardEndpointById, merchantCardEndpointLive, merchantCardEndpointMatches, merchantCardEndpointRecognizerById, merchantCardEndpointSessionRefusal, merchantEndpointRequest, responseCardLeak, substituteMerchantCardEndpoint, trustedMerchantCardEndpoint };
+var GET_REDIRECTS = /* @__PURE__ */ new Set([301, 302, 303]);
+function merchantCardEndpointNavigationAnswer(profile, answer, requestUrl) {
+    const p = trustedMerchantCardEndpoint(profile);
+    const status = isPlainObject(answer) ? answer.status : void 0;
+    if (p.navigation === null || !Number.isInteger(status) || status < 300 || status > 399)
+        return { kind: "page" };
+    if (!GET_REDIRECTS.has(status))
+        return { kind: "refused", reason: "redirect_repeats_post" };
+    const location = isPlainObject(answer.headers) ? answer.headers.location : void 0;
+    let target = null;
+    if (typeof location === "string" && location.length <= MERCHANT_CARD_ENDPOINT_LIMITS.urlLength && /^[\x21-\x7e]+$/.test(location)) {
+        try {
+            target = new URL(location, requestUrl);
+        }
+        catch {
+            target = null;
+        }
+    }
+    if (!target || target.protocol !== "https:" || target.username || target.password)
+        return { kind: "refused", reason: "redirect_location_invalid" };
+    return { kind: "redirect", status, location: target.href };
+}
+export { HILTON_CREATE_RESERVATION_DOCUMENTS, MERCHANT_CARD_ENDPOINT_CLIENT_TABLE, MERCHANT_CARD_ENDPOINT_FACTS_TEXT_MAX, MERCHANT_CARD_ENDPOINT_FACT_READERS, MERCHANT_CARD_ENDPOINT_LIMITS, MERCHANT_CARD_ENDPOINT_MODE, MERCHANT_CARD_ENDPOINT_PROFILES, MERCHANT_CARD_ENDPOINT_PSP, MERCHANT_CARD_ENDPOINT_RECOGNIZERS, SubstitutionError, assertMerchantCardEndpoint, encryptMerchantCardEndpointBody, encryptedMerchantEndpointRequest, matchMerchantCardEndpoint, matchMerchantCardEndpointResend, merchantCardEndpointAmount, merchantCardEndpointAnswer, merchantCardEndpointAnswerRefusal, merchantCardEndpointBodyRefusal, merchantCardEndpointById, merchantCardEndpointCarriesCard, merchantCardEndpointCheckoutKey, merchantCardEndpointEncrypts, merchantCardEndpointFactsRefusal, merchantCardEndpointFactsRole, merchantCardEndpointLive, merchantCardEndpointMatches, merchantCardEndpointNavigationAnswer, merchantCardEndpointPasses, merchantCardEndpointRecognizerById, merchantCardEndpointRequestOrigin, merchantCardEndpointSessionRefusal, merchantCardEndpointSessionTtl, merchantEndpointRequest, projectMerchantCardEndpointFacts, readMerchantCardEndpointFacts, responseCardLeak, substituteMerchantCardEndpoint, trustedMerchantCardEndpoint };