@agent-cards/sdk 0.23.2 → 0.23.4

package/CHANGELOG.md

@@ -2,12 +2,28 @@
 
 ## Unreleased
 
+- Stop PayPal's legacy Hosted Fields from sending the card your agent typed to PayPal's payment confirm. A checkout that loads PayPal's JS SDK with `components=hosted-fields`, such as Planet Golf UK's PayPal Checkout, takes the card in frames on `assets.braintreegateway.com` and sends it to `https://cors.api.paypal.com/v2/checkout/orders/{id}/confirm-payment-source` (`cors.api.sandbox.paypal.com` in PayPal's sandbox). No Agentcard payment takes that request over, and earlier releases let it through, so PayPal received the dummy card and declined it. Both adapters now fail that request in the browser for every company, whatever `syncRegistry()` served, and the controller reads `unsupported` with reason `unsupported_paypal_hosted_fields` and holds, like every `unsupported` reason: to pay another way on the same page, attach again. A confirm with no card number, such as a PayPal wallet payment, continues untouched. A confirm whose body the SDK cannot read is failed with a `blocked` event, `unreadable_paypal_request`, and the checkout is not held. A merchant that turns on PayPal's card installments also has the card number field send each typed number to PayPal's installment lookup, `/v1/credit/calculated-financing-options`; the SDK leaves that lookup alone, and it pays nothing. TypeScript: the controller's `unsupported()` reasons gain `unsupported_paypal_hosted_fields`; code that switches exhaustively over them needs the new case.
+
+- Name PayPal's legacy Hosted Fields as PayPal in a preflight inspection, not as Braintree. Their card fields are braintree-web builds whose version carries `-payments-sdk` (`3.32.0-payments-sdk-dev` on Planet Golf UK), and inspection read the page as `braintree` with status `supported`. The frames now name `paypal`, and the result stays `unknown` with `processor_variant_unverified`. A braintree-web script from a `-payments-sdk` build is no longer Braintree evidence either, and a variant seen in several frames lists its limitation once. The catalog's `catalog_sha256` changes; `catalog_version` stays `2026-09-15.1`.
+
+- Stop the card request AT&T's checkout sends today. AT&T's page posts the card to `/msapi/checkoutorch/v1/mfe/paymentInfo` with no query, and the adapters armed only the exporch form, `/msapi/checkoutexporch/v1/paymentInfo?cartId=`, which none of the checkouts Agentcard read live used, so the agent's dummy card reached AT&T. The adapters now pause the request AT&T sends and refuse it as `unsupported_checkout` while AT&T's profile is in `observe`. The exporch form is a profile of its own, `att_exporch_payment_info`, refused the same way, so a cart AT&T moves there is stopped too. AT&T's card-on-file step, which posts the typed card to `cardOnFile` on either base, is aborted in every status as `card_endpoint_refused` with reason `card_resend`, and so is the exporch form with no query, with its card-on-file step: AT&T's page sends both when its checkout names no cart id, and no payment can cover them. AT&T's profile reads the body its page builds: no `X-CSRF-TOKEN` on a guest checkout, `type` `creditcard` or `debitcard`, `statusCode` and `transactionId` as null, `cardSubType` one of `VISA`, `MASTERCARD`, `AMEX` or `DISCOVER`, a two-digit month and a four-digit year.
+
+- Recognize Target Optical's card request as its checkout sends it today: a JSON `PUT` to `/wcs/resources/store/12001/cart/@self/addPayment` with the page's `nocache` query, the total in `piAmount` with five decimals (`"49.42000"`). The profile described the form post Target Optical's older checkout sent, which no request matches now, so the adapters let the dummy card reach Target Optical. The profile stays in observe: both adapters now pause that request and refuse it as `unsupported_checkout` before any authorization, let the saved-card body to the same URL through untouched, and abort the card save a signed-in shopper's page sends to `/wcs/resources/store/12001/mypayments` in every status. They also abort, in every status, a post to `/AjaxOrderChangeServicePIAddTO`, the form endpoint the older checkout used, which they refused before and which the storefront still declares in a script it serves, so moving the profile to the `PUT` leaves no path where the dummy card reaches Target Optical. `attachToPlaywright` routes a reviewed card endpoint's request by every method the profiles name; it asked only for `POST`, so a `PUT` card request or resend never reached its gates. A card endpoint create names the profile's own method in `request.method`; an API that reads every card endpoint request as a `POST` refuses a `PUT` create with `invalid_request`, so nothing is charged. TypeScript: `CardEndpointProfile.method` can be `PUT`.
+
+- Pay Cinemark and Dick's Sporting Goods' own storefront, two reviewed Adyen merchants that take the card on their own server. Both profiles, `cinemark_initiate` and `dsg_paygate_v2`, ship `enabled`, and the API serves them `enabled` only to a client of a company Agentcard turned them on for. For every other client the adapters keep pausing and aborting their card requests as `merchant_profile_observed`, as before. A payment there needs a preparation for the profile and the cardholder's approval in the Vault, and Autopilot never pays one. The create carries the merchant's own checkout total as your agent's browser read it, and the API refuses a payment whose amount is not that total. Dick's paygate at Golf Galaxy, Public Lands and Going Going Gone moves to its own profile, `dsg_other_stores_paygate_v2`, which ships in `observe`, so the adapters abort those card requests as before. Matching API and Vault releases are required.
+
 - Stop the card fields adyen-web 5 encrypts at a reviewed Adyen merchant profile. adyen-web 5 seals each field as an RSA-OAEP / A256CBC-HS512 JWE, where adyen-web 6 writes RSA-OAEP-256 / A256GCM, and the SDK read only adyen-web 6's form. So the card requests of Cathay Pacific's payment page and Dunelm's legacy checkout, and Cathay's charge request after its signing step, reached the merchant with the agent's dummy card. The adapters now read both forms as a card. Both profiles ship in `observe`, so the adapters abort each of these requests before it leaves the browser and report it as `merchant_profile_observed`. The Vault writes only adyen-web 6's form, so the API refuses a create for a card request in adyen-web 5's form with `cse_template_unsupported`, and nothing is charged.
 
 - Abort the requests in which IHG's pay page sends the typed card outside its reviewed card request, in every status, as `card_endpoint_refused` with reason `card_resend`. The page posts the same booking to IHG's enrollment service while its pre-ticked "Enroll for free" box stays ticked, posts it on other paths for more than one room, a travel agent or Business Rewards, and at a hotel that asks for 3-D Secure first posts the number to two 3-D Secure calls. The SDK let each of these reach IHG with the agent's dummy card. A booking with the box unticked reaches IHG's reviewed card request, which the adapters refuse as before while IHG is in `observe`.
 
 - Read IHG's booking at a hotel that asks for no security code as IHG's reviewed card request. At the two US hotels a live check visited, the pay page shows no security code field and sends `cvvNumber: {token: ""}`. The adapters read that as a card in a body IHG's profile did not review and refused it with reason `unrecognized_payment_endpoint`, so the booking could never pause for the cardholder. They now refuse it with reason `merchant_card_endpoint_not_enabled`, naming IHG's profile, while IHG is in `observe`, and once Agentcard enables IHG it pauses and asks the cardholder like any other IHG booking. A security code the hotel asks for is still read as three or four digits, and any other value there is refused as before.
 
+- Read a hotel booking at IHG, Hilton or The Verb Hotel as the hotel's reviewed card request only at a rate the hotel charges in full at booking: IHG's Book Early & Save (`ratePlanCode` `IDAPF`) in the hotel's own currency, a Hilton rate guaranteed `FP` with a deposit, and The Verb Hotel's Non-Refundable rate (`14DAYAP`). The adapters now refuse a rate that holds the card and charges it at the stay, an IHG group rate, an IHG booking that names `hotels[0].bookingCurrency` (the shopper's currency, which IHG's page sends only when the hotel prices in another one) and a Hilton booking with its pre-ticked "Join Hilton Honors for free" left on (`variables.enrollment`) with reason `unrecognized_payment_endpoint` and an event that names only the endpoint, where they refused each as `merchant_card_endpoint_not_enabled` naming the profile. All three hotels stay in `observe`, so the adapters refuse every booking there before any authorization, as before. IHG's and Hilton's profiles now carry the card network codes their pages write (VS, MC, AX and DS at IHG; VI, MC, AX and DS at Hilton): a body that names another code is unrecognized, and once a hotel is enabled the cardholder's device writes the code of the real card's network and refuses a card on any other. Hilton's profile reads `charge_timing: 'at_request'`, since Hilton charges its prepaid rate at booking. Italo's profile no longer waits on how its page sends `expire`, which the live checks of Sep 30 and Oct 6 read as left out.
+
+- Stop Universal Orlando's card request at the checkout it runs today. Universal moved its store from `www.universalorlando.com/web-store` to `store.universalorlando.com`, whose guest checkout posts the card to `secure-api.universalparks.com/instances/{guest}/carts/{cart}/precheckout`. The SDK's profile still described the web-store request, so it let this one through and the agent's dummy card reached Universal. The adapters now refuse it before it leaves the browser with reason `merchant_card_endpoint_not_enabled`, naming Universal's profile, while Universal is in `observe`. They also abort the store's two other posts of the typed card, a signed-in customer's precheckout and the Cardinal 3-D Secure token call Universal keeps off today, in every status, as `card_endpoint_refused` with reason `card_resend`. The retired web-store checkout still loads from a deep link such as `www.universalorlando.com/web-store/en/us/checkout`, and the adapters abort its two posts of the typed card the same way: a guest's `/instances/{guest}/commerce-checkout`, the request they refused before this release, and a signed-in customer's `/guests/{guest}/commerce-checkout`. Once Agentcard enables Universal, the API takes one payment per cart and refuses another create for it with `409 merchant_checkout_in_use`.
+
+- Read the card number on the D-EDGE card frame the way the frame groups each card network: 4-6-5 for an American Express number, 4-6-4 for a Diners Club number starting 36 or 300 to 305, and groups of four for any other. The SDK's copy of D-EDGE's rules read a grouped number only in groups of four, so an American Express or Diners Club placeholder as the frame groups it was not D-EDGE's reviewed card request, and the same number in groups of four, which the frame never posts, was. D-EDGE stays in `observe`, so its card post still gets the page that says Agentcard has not turned it on.
+
 ## 0.23.0
 
 ### Upgrading from 0.22.0

package/PREFLIGHT.md

@@ -207,6 +207,8 @@ The bundled direct SDK profile declares processor support for `one_time` purchas
 
 The catalog also carries reviewed hosted, regional, and versioned variants observed on live checkouts: Adyen secured fields on the regional live hosts and any release, the Square card element frame, dLocal Smart Fields releases, Mercado Pago secure fields and the guest Checkout Pro card form, and the Rapyd hosted checkout page. A variant the implemented adapter does not admit, such as the Tranzila terminal-root page, the Authorize.Net hosted payment form, or a Worldpay hosted payment page, identifies its processor and returns `unknown` with `processor_variant_unverified`. A new fingerprint never declares payment support by itself.
 
+PayPal's legacy Hosted Fields (`paypal`) are identified from the card fields PayPal's JS SDK renders with `components=hosted-fields`: braintree-web builds whose version carries `-payments-sdk`, such as `3.32.0-payments-sdk-dev`, served from `assets.braintreegateway.com` as `hosted-fields-input-frame.min.html` and `hosted-fields-payments-sdk-tokenization-frame.min.html`. PayPal's frames send the card to PayPal, not to Braintree, so a page that shows them names `paypal` and returns `unknown` with `processor_variant_unverified`, and no braintree-web file from a `-payments-sdk` build counts as Braintree evidence. The SDK fails the card request those frames send; see the PayPal Hosted Fields row in the [README's processor table](./README.md#supported-processors).
+
 Adyen's `supported` covers the Sessions payment request on Adyen's own hosts. Some Adyen merchants post the four encrypted fields to their own server instead, and their pages load the same secured fields, so an inspection identifies Adyen on both and cannot tell the two flows apart. The SDK pays a merchant's own endpoint only through a merchant profile Agentcard reviewed for it; the reviewed profiles (Dunelm and Cinemark) are in `observe`, so the SDK aborts their card requests and nothing is charged. The `actual_payment_request_validation` requirement is where that difference shows: check the paused request's host before treating an Adyen result as payable.
 
 Authorize.Net Direct Post Method and SIM ship dark. The SDK pauses their `transact.dll` card form only for an org Agentcard enabled for them (capability `authorize_net_dpm_form`), and the bundled catalog leaves them out, so the table above does not list them and inspection answers for their forms exactly as it did before: the SIM hosted form on `secure.authorize.net` identifies Authorize.Net and returns `unknown` with `processor_variant_unverified`.

package/README.md

@@ -254,7 +254,8 @@ Coverage is specific to the processor request format, merchant setup, browser tr
 | Checkout.com | supported |
 | Mercado Pago | Card tokenization and prepared checkout are implemented. Guest Checkout Pro in Mexico also corrects the issuer for one native card association when the selected card has the same brand and type. One live MXN 40 Lotería Chida purchase with published SDK 0.10.0 completed automatically through Pay; the merchant confirmed paid status and PDF fulfillment. The historical SDK result remains unknown because the private receipt adapter rejected a relative download URL; a separate read with the corrected adapter confirms that same paid receipt. Independent processor capture/settlement and other country or integration paths remain unverified. |
 | VGS Collect (Very Good Security; Wolt) | not supported: VGS's proxy aliases only submissions from its own iframe, so a replay from the cardholder's device is refused by the merchant (verified on Wolt, 2026-09-03). Not recognized, so the agent's browser is not paused there |
-| Adyen | supported (mode `cse`): the vault encrypts the card for Adyen on the cardholder's device and your browser sends it. Sessions flow: the paused request is `/checkoutshopper/v1/sessions/{id}/payments` on Adyen's own hosts. A merchant that posts the encrypted fields to its own server pauses only when Agentcard reviewed it as a merchant profile (Dunelm and Cinemark so far); both profiles are in `observe`, so their card requests are reported and aborted and nothing pays there yet (see "Adyen merchants that take the card on their own server"). Without a preparation, approval starts at Pay and must land before Adyen Web's own request timeout (observed at 60 seconds on Adyen Web 6.41 and 6.44; not enforced by the SDK); `prepare({ psp: 'adyen' })` moves the approval before Pay |
+| PayPal Hosted Fields (the legacy card fields of PayPal's JS SDK; Planet Golf UK) | not supported: no Agentcard payment takes over the card these fields send to `cors.api.paypal.com`. The SDK fails that request for every company, so PayPal's payment confirm never receives the dummy card, and the controller reads `unsupported` with reason `unsupported_paypal_hosted_fields` and holds the attachment until you attach again; a PayPal wallet payment continues untouched |
+| Adyen | supported (mode `cse`): the vault encrypts the card for Adyen on the cardholder's device and your browser sends it. Sessions flow: the paused request is `/checkoutshopper/v1/sessions/{id}/payments` on Adyen's own hosts. A merchant that posts the encrypted fields to its own server pauses only when Agentcard reviewed it as a merchant profile. Cinemark and Dick's Sporting Goods' own storefront take payments for a company Agentcard turned them on for; every other reviewed merchant is in `observe`, so its card requests are reported and aborted and nothing pays there yet (see "Adyen merchants that take the card on their own server"). Without a preparation, approval starts at Pay and must land before Adyen Web's own request timeout (observed at 60 seconds on Adyen Web 6.41 and 6.44; not enforced by the SDK); `prepare({ psp: 'adyen' })` moves the approval before Pay |
 | ACI Worldwide COPYandPAY (Halfords) | dark launch: served only after `syncRegistry()` and only for an org Agentcard enabled; prepared checkout only. The card-number request is replayed from the cardholder's device, the page's own CVC and expiry requests are answered locally, and `/payment` continues once. See [Pay an ACI COPYandPAY checkout](#pay-an-aci-copyandpay-checkout) |
 | Tranzila | supported (mode `hosted_form`): the cardholder finishes on Tranzila's own page; the paused form navigation resolves to a synthetic page, and you poll the merchant's order state |
 | Fiserv Commerce Hub | implemented (mode `cse`, prepared checkout only) and off until Agentcard turns it on for your company: the card frame's card capture on `connect.fiservapis.com` (or `connect-cert.fiservapis.com` in the sandbox), with the approved card encrypted on the cardholder's device under a key Agentcard reviewed for the merchant. A merchant whose frame posts to Fiserv's `payment-link` endpoint is not recognized. No live merchant purchase is verified yet |
@@ -424,21 +425,25 @@ mode; the difference matters if you drive `authorize()` yourself.
   page's origin, the exact origin, path and query of the card request, the
   session headers and cookies it needs, and the answer headers that may come
   back. The adapters arm every profile's endpoint (`cardEndpointPatterns()`
-  lists the `Fetch.enable` patterns) and pause a POST to exactly a profile's
-  card request URL when it carries a card: anything at the profile's card
-  number field, or a Luhn-valid number of 12 to 19 digits anywhere in the
-  body, however it is written. A body the adapter cannot read counts as
-  carrying one. A GET, a CORS preflight, a look-alike URL, or a POST to the
-  same URL with no card in it (an IHG stay paid with points, a LookFantastic
-  order whose card a processor's own fields tokenized, a saved card, a room
-  another SynXis hotel guarantees with a token) continues untouched. While this
+  lists the `Fetch.enable` patterns) and pause a request to exactly a
+  profile's card request URL, sent with the profile's own method (a POST, or
+  the PUT Target Optical's checkout sends), when it carries a card: anything
+  at the profile's card number field, or a Luhn-valid number of 12 to 19
+  digits anywhere in the body, however it is written. A body the adapter
+  cannot read counts as carrying one. A GET, a CORS preflight, another
+  method, a look-alike URL, or a request to the same URL with no card in it
+  (an IHG stay paid with points, a saved card, a room another SynXis hotel
+  guarantees with a token) continues untouched. While this
   build's copy of a profile does not take payments (every profile is in
   observe today) a card request is refused as `unsupported_checkout` before
   any authorization exists. When the body is the request the profile
   reviewed, the controller reads `unsupported` with reason
   `merchant_card_endpoint_not_enabled` and the event names the profile; a
   card in any other body reads reason `unrecognized_payment_endpoint`, and
-  the event names only the endpoint origin. For a
+  the event names only the endpoint origin. LookFantastic's checkout takes
+  the card in BR-DGE's card fields and then sends the masked card number
+  BR-DGE returns in its order, so the adapters refuse that order with reason
+  `unrecognized_payment_endpoint`. For a
   profile that takes payments, the adapter captures the request's session:
   the profile's own header names from the paused request, the endpoint's
   cookie jar for a cookie profile (`Network.getCookies` or
@@ -1247,7 +1252,7 @@ Some Adyen merchants have adyen-web encrypt the card into four fields and post t
 
 - A request that carries no encrypted card (a basket query, a preflight) continues as before.
 - A body the browser did not hand over (a blob or a file, which neither adapter can read) is not proven card-free, so any request but a `GET`, `HEAD` or `OPTIONS` that carries one is treated as a card request the profile cannot finish. Playwright reports a missing body the same way, so an empty body is treated alike in both adapters.
-- A profile in `observe` never pays. Its card request is aborted before it reaches the merchant, and the adapters report `merchant_profile_observed` with the profile, the templated URL, the verdict and `keyPathSha256`, the SHA-256 of the body's sorted key paths (never a value; `null` for a body that was not read), then `unsupported_checkout`. The controller reads `unsupported` with reason `merchant_profile_observe`, and no authorization exists. Both reviewed profiles, `dunelm_was_graphql` and `cinemark_initiate`, ship in `observe`.
+- A profile in `observe` never pays. Its card request is aborted before it reaches the merchant, and the adapters report `merchant_profile_observed` with the profile, the templated URL, the verdict and `keyPathSha256`, the SHA-256 of the body's sorted key paths (never a value; `null` for a body that was not read), then `unsupported_checkout`. The controller reads `unsupported` with reason `merchant_profile_observe`, and no authorization exists. `cinemark_initiate` and `dsg_paygate_v2` (Dick's Sporting Goods' own storefront) ship `enabled`, and the API serves them `enabled` only to a client of a company Agentcard turned them on for. Every other reviewed profile ships in `observe`, `dunelm_was_graphql` and `dsg_other_stores_paygate_v2` (Dick's paygate at Golf Galaxy, Public Lands and Going Going Gone) among them.
 - A card request the profile cannot finish (storing the card, a stored card, another operation, three fields instead of four, a sibling endpoint, an unreadable body) is aborted with `unsupported_checkout` and the reason, and reads `unsupported` with reason `merchant_request_unsupported`.
 - The profile's own card request, once Agentcard enables the profile for your client and this build, pays only through a preparation for that profile. Without one it is aborted before any pause, prompt or authorization: the adapters report `blocked` with `preparation_required`, the controller reads `failed` with that reason, and `prepare()` is refused on that attachment, as after any first card request. Create a new attachment and prepare before Pay.
 
@@ -1261,7 +1266,7 @@ After hand-off, a `5xx` final answer (after any redirect), a network failure, or
 
 #### Testing against your own Adyen TEST account
 
-A test-mode client can run the same checkout against its own server and its own Adyen TEST account, before any reviewed profile is enabled. Declare your endpoint on the client, before any attach, as taking the card request of a profile this build reviewed:
+A test-mode client can run the same checkout against its own server and its own Adyen TEST account, whether or not Agentcard has enabled the reviewed profile. Declare your endpoint on the client, before any attach, as taking the card request of a profile this build reviewed:
 
 ```ts
 const vault = new VaultClient({ clientId, clientSecret, sandboxMerchants: [

package/dist/adyen-merchant-hosted.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: c979802cf1a5aa95eedd5dd00949cd56c5c478ca3c637b3232b69597cc62d4a4
+// artifact-sha256: 4790fdfc656acbda50ddf8471507933ddd4938f4c5b351ec096a9549a7c8c257
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -1086,6 +1086,118 @@ function selectMerchantExchanges(profile, stageName, input) {
     return { ok: true, responses: newestMerchantExchanges(kept) };
 }
 // src/merchant-profiles.js
+var DSG_PAYGATE_V2 = /* @__PURE__ */ deepFreeze({
+    method: "POST",
+    path: "/prod/api/paygate/v2/authorization",
+    query: {},
+    // The page sends true for every checkout its translator read, the only checkouts
+    // the amount source below maps; a legacy checkout is not this card request.
+    requires: [{ path: ["isModernOrder"], equals: true }],
+    holder: ["tenders", "encryptedCardTenders", 0],
+    fields: {
+        encryptedCardNumber: "cardNumber",
+        encryptedExpiryMonth: "expirationMonth",
+        encryptedExpiryYear: "expirationYear",
+        encryptedSecurityCode: "cvv"
+    },
+    // cardType and vinBalue describe the dummy the agent typed: the facts below
+    // write the approved card's instead, so nothing is removed.
+    remove: [],
+    refuse: [
+        { path: ["tenders", "encryptedCardTenders", 0, "saveForLater"], when: "true" },
+        // A saved card, or a second card tender the Vault never encrypted.
+        { path: ["tenders", "savedCardTender"], when: "present" },
+        { path: ["tenders", "encryptedCardTenders", 1], when: "present" },
+        // A gift card pays part of the order, so the card pays less than the total.
+        { path: ["tenders", "giftCardTenders"], when: "present" }
+    ],
+    amount: null,
+    // Read Sep 25, 2026 (research amount_source/dickssportinggoods). Every checkout call
+    // on the checkout page answers the whole checkout, camelCase on the wire: the page
+    // load's PATCH (or the create), then every address, shipping, promotion, gift card,
+    // tip and ScoreCard change. pricing.totalRemaining is what the card pays, a string
+    // with exactly two decimals ("123.45"; the page itself drops the dot for minor
+    // units). transactionReference is the checkout key, in the body and the URL. After
+    // payment the order submit and the confirmation read return the placed checkout.
+    amountSource: {
+        id: "dsg_checkout_pricing",
+        origin: "checkout",
+        format: "json",
+        responses: [
+            { method: "PATCH", path: "/api/v1/checkouts/:checkoutKey", query: {} },
+            { method: "POST", path: "/api/v1/checkouts", query: {} },
+            { method: "POST", path: "/api/v1/checkouts/:checkoutKey/addresses", queries: [{}, { type: "billing" }, { type: "shipping" }] },
+            { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/shipping/selected/groups/:groupNumber/mode", query: {} },
+            { method: "PUT", path: "/api/v2/checkouts/:checkoutKey/promotion/cart", query: {} },
+            { method: "DELETE", path: "/api/v2/checkouts/:checkoutKey/promotion/cart", query: {} },
+            { method: "POST", path: "/api/v1/checkouts/:checkoutKey/gift-cards", query: {} },
+            { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/gift-cards/:giftCardIndex", query: {} },
+            { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/tip", query: {} },
+            { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/scorecard", query: {} },
+            { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/scorecard", query: {} },
+            { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/v2/gifts", query: {} }
+        ],
+        total: { path: ["pricing", "totalRemaining"], format: "decimal2" },
+        unit: "major",
+        currency: "USD",
+        currencyPath: ["pricing", "currency"],
+        bind: [
+            { source: ["checkoutKey"], card: ["transactionReference"] },
+            { placeholder: "checkoutKey", card: ["transactionReference"] }
+        ],
+        // The order total and the card's share are the same text. Anything that lowers the
+        // share below the total (a gift card, ScoreCard rewards) or lands in only one of them
+        // (a tip, a donation) is refused until a HAR shows which one the charge follows, so
+        // the approved amount and the placed checkout's total read after payment agree.
+        requires: [{ path: ["pricing", "total"], equalsPath: ["pricing", "totalRemaining"] }],
+        refuse: [
+            // A placed checkout is not the one being paid.
+            { path: ["orderPlacedTime"], when: "true" },
+            // Gift cards and a checkout with no address yet (tax not estimated) wait for a HAR.
+            { path: ["payment", "giftCards"], when: "nonEmpty" },
+            { path: ["addresses"], when: "empty" }
+        ],
+        maxAgeMs: 9e5,
+        afterPayment: {
+            origin: "checkout",
+            format: "json",
+            responses: [
+                { method: "POST", path: "/api/v1/checkouts/:checkoutKey", query: {} },
+                { method: "GET", path: "/api/v1/checkouts/submitted/:checkoutKey", query: {} }
+            ],
+            // The order total, which the requires rule above held equal to the card's share
+            // before payment. totalRemaining is not read here: after placement it can drop to
+            // what is still unpaid, which would hide a higher charge.
+            total: { path: ["pricing", "total"], format: "decimal2" },
+            unit: "major",
+            currency: "USD",
+            currencyPath: ["pricing", "currency"],
+            bind: [
+                { source: ["checkoutKey"], card: ["transactionReference"] },
+                { placeholder: "checkoutKey", card: ["transactionReference"] }
+            ],
+            refuse: [{ path: ["orderPlacedTime"], when: "unset" }]
+        }
+    },
+    facts: [
+        // adyen-web's brand codes, the ones the page's supported list names; Dick's own
+        // private-label (plcc, comc) cards have no Agentcard brand and are refused.
+        {
+            path: ["tenders", "encryptedCardTenders", 0, "cardType"],
+            fact: "brand",
+            map: { visa: "visa", mastercard: "mc", amex: "amex", discover: "discover", diners: "diners", jcb: "jcb" }
+        },
+        { path: ["tenders", "encryptedCardTenders", 0, "vinBalue"], fact: "bin6" }
+    ],
+    adyen: {
+        environment: "live",
+        clientKey: "live_YJLFKT47JJG2RI7QIYX6HTKKDEDOEGOH",
+        publicKeySha256: "da33611149dff3ab715be8671c0550bb8aec6112983b2473db9ee7afb829c110"
+    }
+});
+function dsgPaygateProfile(own) {
+    return { ...own, ...DSG_PAYGATE_V2 };
+}
 var MERCHANT_HOSTED_PROFILES = /* @__PURE__ */ deepFreeze([
     {
         // Read Sep 23, 2026. assets.dunelm.com checkout-page bundle: submitPayment
@@ -1181,10 +1293,13 @@ var MERCHANT_HOSTED_PROFILES = /* @__PURE__ */ deepFreeze([
         // client key from the three securedFields iframes on
         // checkoutshopper-live-us.adyen.com (adyen-web 6.x). The request body itself
         // was not captured: the guest email gate stopped the run before Pay. Public
-        // key read from checkoutshopper-live-us.adyen.com on 2026-09-25 (UTC).
+        // key read from checkoutshopper-live-us.adyen.com on 2026-09-25 (UTC). Enabled
+        // Oct 7, 2026 under D1 (amountSource, above): live checks on Sep 30 and Oct 6
+        // matched its key pin, its card request as the page's script builds it, and its
+        // checkout total.
         id: "cinemark_initiate",
         merchant: "Cinemark",
-        status: "observe",
+        status: "enabled",
         origins: [{ checkout: "https://www.cinemark.com", endpoint: "https://www.cinemark.com" }],
         method: "POST",
         path: "/api/adyen/initiatePayment",
@@ -1257,137 +1372,29 @@ var MERCHANT_HOSTED_PROFILES = /* @__PURE__ */ deepFreeze([
             publicKeySha256: "9dd5ef549c7454d60ca970ff76c8f4cac36d79f2961e59eca9116791e86cbcc5"
         }
     },
-    {
-        // Read Sep 23, 2026. payments.dickssportinggoods.com/library/dppjs/index-v2.js
-        // (adyen-web 6.39.0): Dd() builds tenders.encryptedCardTenders[0] from the Card
-        // component's four JWEs as cardNumber, expirationMonth, expirationYear and cvv,
-        // beside cardType (adyen-web's first detected brand), saveForLater (the save-card
-        // box) and vinBalue (the six digits onBinValue reports). The page posts it with
-        // transactionReference, customer.device and any giftCardTenders to
-        // <payments host>/prod/api/paygate/v2/authorization, the host picked from the
-        // page's own (Dick's, Golf Galaxy, Public Lands, Going Going Gone). The same slot
-        // carries Afterpay, CashApp and Affirm tenders with literal strings where the JWEs
-        // go, and a saved card goes to tenders.savedCardTender instead. The body names no
-        // amount: the paygate charges the cart it holds for transactionReference.
-        // mountCCForm names the client key and environment 'live'. Public key read from
-        // checkoutshopper-live.adyen.com on 2026-09-25 (UTC).
+    /* @__PURE__ */ dsgPaygateProfile({
+        // Dick's own storefront, the one live checks read on Sep 30 and Oct 6, 2026: its key
+        // pin, its card request as the page's code builds it, its card facts and its checkout
+        // pricing matched DSG_PAYGATE_V2. Enabled Oct 7, 2026 under D1 (amountSource, above).
         id: "dsg_paygate_v2",
         merchant: "Dick's Sporting Goods",
+        status: "enabled",
+        origins: [
+            { checkout: "https://www.dickssportinggoods.com", endpoint: "https://payments.dickssportinggoods.com" }
+        ]
+    }),
+    /* @__PURE__ */ dsgPaygateProfile({
+        // The same paygate on the three other storefronts its page names. No live check has
+        // read them, so their card requests stay paused and aborted in observe.
+        id: "dsg_other_stores_paygate_v2",
+        merchant: "Golf Galaxy, Public Lands and Going Going Gone",
         status: "observe",
         origins: [
-            { checkout: "https://www.dickssportinggoods.com", endpoint: "https://payments.dickssportinggoods.com" },
             { checkout: "https://www.golfgalaxy.com", endpoint: "https://payments.golfgalaxy.com" },
             { checkout: "https://www.publiclands.com", endpoint: "https://payments.publiclands.com" },
             { checkout: "https://www.goinggoinggone.com", endpoint: "https://payments.goinggoinggone.com" }
-        ],
-        method: "POST",
-        path: "/prod/api/paygate/v2/authorization",
-        query: {},
-        // The page sends true for every checkout its translator read, the only checkouts
-        // the amount source below maps; a legacy checkout is not this card request.
-        requires: [{ path: ["isModernOrder"], equals: true }],
-        holder: ["tenders", "encryptedCardTenders", 0],
-        fields: {
-            encryptedCardNumber: "cardNumber",
-            encryptedExpiryMonth: "expirationMonth",
-            encryptedExpiryYear: "expirationYear",
-            encryptedSecurityCode: "cvv"
-        },
-        // cardType and vinBalue describe the dummy the agent typed: the facts below
-        // write the approved card's instead, so nothing is removed.
-        remove: [],
-        refuse: [
-            { path: ["tenders", "encryptedCardTenders", 0, "saveForLater"], when: "true" },
-            // A saved card, or a second card tender the Vault never encrypted.
-            { path: ["tenders", "savedCardTender"], when: "present" },
-            { path: ["tenders", "encryptedCardTenders", 1], when: "present" },
-            // A gift card pays part of the order, so the card pays less than the total.
-            { path: ["tenders", "giftCardTenders"], when: "present" }
-        ],
-        amount: null,
-        // Read Sep 25, 2026 (research amount_source/dickssportinggoods). Every checkout call
-        // on the checkout page answers the whole checkout, camelCase on the wire: the page
-        // load's PATCH (or the create), then every address, shipping, promotion, gift card,
-        // tip and ScoreCard change. pricing.totalRemaining is what the card pays, a string
-        // with exactly two decimals ("123.45"; the page itself drops the dot for minor
-        // units). transactionReference is the checkout key, in the body and the URL. After
-        // payment the order submit and the confirmation read return the placed checkout.
-        amountSource: {
-            id: "dsg_checkout_pricing",
-            origin: "checkout",
-            format: "json",
-            responses: [
-                { method: "PATCH", path: "/api/v1/checkouts/:checkoutKey", query: {} },
-                { method: "POST", path: "/api/v1/checkouts", query: {} },
-                { method: "POST", path: "/api/v1/checkouts/:checkoutKey/addresses", queries: [{}, { type: "billing" }, { type: "shipping" }] },
-                { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/shipping/selected/groups/:groupNumber/mode", query: {} },
-                { method: "PUT", path: "/api/v2/checkouts/:checkoutKey/promotion/cart", query: {} },
-                { method: "DELETE", path: "/api/v2/checkouts/:checkoutKey/promotion/cart", query: {} },
-                { method: "POST", path: "/api/v1/checkouts/:checkoutKey/gift-cards", query: {} },
-                { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/gift-cards/:giftCardIndex", query: {} },
-                { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/tip", query: {} },
-                { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/scorecard", query: {} },
-                { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/scorecard", query: {} },
-                { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/v2/gifts", query: {} }
-            ],
-            total: { path: ["pricing", "totalRemaining"], format: "decimal2" },
-            unit: "major",
-            currency: "USD",
-            currencyPath: ["pricing", "currency"],
-            bind: [
-                { source: ["checkoutKey"], card: ["transactionReference"] },
-                { placeholder: "checkoutKey", card: ["transactionReference"] }
-            ],
-            // The order total and the card's share are the same text. Anything that lowers the
-            // share below the total (a gift card, ScoreCard rewards) or lands in only one of them
-            // (a tip, a donation) is refused until a HAR shows which one the charge follows, so
-            // the approved amount and the placed checkout's total read after payment agree.
-            requires: [{ path: ["pricing", "total"], equalsPath: ["pricing", "totalRemaining"] }],
-            refuse: [
-                // A placed checkout is not the one being paid.
-                { path: ["orderPlacedTime"], when: "true" },
-                // Gift cards and a checkout with no address yet (tax not estimated) wait for a HAR.
-                { path: ["payment", "giftCards"], when: "nonEmpty" },
-                { path: ["addresses"], when: "empty" }
-            ],
-            maxAgeMs: 9e5,
-            afterPayment: {
-                origin: "checkout",
-                format: "json",
-                responses: [
-                    { method: "POST", path: "/api/v1/checkouts/:checkoutKey", query: {} },
-                    { method: "GET", path: "/api/v1/checkouts/submitted/:checkoutKey", query: {} }
-                ],
-                // The order total, which the requires rule above held equal to the card's share
-                // before payment. totalRemaining is not read here: after placement it can drop to
-                // what is still unpaid, which would hide a higher charge.
-                total: { path: ["pricing", "total"], format: "decimal2" },
-                unit: "major",
-                currency: "USD",
-                currencyPath: ["pricing", "currency"],
-                bind: [
-                    { source: ["checkoutKey"], card: ["transactionReference"] },
-                    { placeholder: "checkoutKey", card: ["transactionReference"] }
-                ],
-                refuse: [{ path: ["orderPlacedTime"], when: "unset" }]
-            }
-        },
-        facts: [
-            // adyen-web's brand codes, the ones the page's supported list names; Dick's own
-            // private-label (plcc, comc) cards have no Agentcard brand and are refused.
-            {
-                path: ["tenders", "encryptedCardTenders", 0, "cardType"],
-                fact: "brand",
-                map: { visa: "visa", mastercard: "mc", amex: "amex", discover: "discover", diners: "diners", jcb: "jcb" }
-            },
-            { path: ["tenders", "encryptedCardTenders", 0, "vinBalue"], fact: "bin6" }
-        ],
-        adyen: {
-            environment: "live",
-            clientKey: "live_YJLFKT47JJG2RI7QIYX6HTKKDEDOEGOH",
-            publicKeySha256: "da33611149dff3ab715be8671c0550bb8aec6112983b2473db9ee7afb829c110"
-        }
-    },
+        ]
+    }),
     {
         // Read Sep 25, 2026, from public code only: the WooCommerce plugin super-payments 1.40.1 and
         // cdn.superpayments.com/js/v2/payment.webcomponents.script.js as it stood on Sep 19.

package/dist/card-endpoint.d.ts

@@ -12,7 +12,8 @@ export interface CardEndpointProfile {
     readonly frame: string | null;
     /** The exact https origin the card request goes to. */
     readonly endpoint: string;
-    readonly method: 'POST';
+    /** A POST, or a PUT for a page that sends its card request as one (Target Optical's addPayment). */
+    readonly method: 'POST' | 'PUT';
     readonly path: string;
     readonly query: Readonly<Record<string, string>>;
     /** json_api is a JSON object sent as application/vnd.api+json. */
@@ -130,6 +131,13 @@ export declare function cardEndpointById(id: string): CardEndpointProfile | null
 export declare function cardEndpointPasses(profile: CardEndpointProfile, body: string | null, contentType: string | undefined): boolean;
 /** The reviewed profile (any status) one of whose resend requests `url` and `method` are, or null: the adapters abort it. */
 export declare function cardEndpointResendFor(url: string, method: string): CardEndpointProfile | null;
+/**
+ * Whether a URL is any profile's card request or one of its resends, by any method the
+ * table names: the Playwright adapter's route filter, which sees the URL alone. The
+ * pre-claim gates then judge each routed request by its own method and body (a GET or a
+ * CORS preflight to the same URL defers), so routing a URL is never a decision to pause it.
+ */
+export declare function cardEndpointRouted(url: string): boolean;
 /** The origins of the profiles whose merchant keeps its own record of the order: the only responses card-endpoint-facts.ts records. */
 export declare function cardEndpointFactsOrigins(): readonly string[];
 /**

package/dist/card-endpoint.js

@@ -11,8 +11,9 @@
 // typed into, the exact origin, path and query of the card request, which session
 // headers and cookies it needs, and which answer headers may travel back.
 //
-// The adapters arm every profile's endpoint. A POST that is exactly a profile's card
-// request URL pauses when it carries a card (cardEndpointCarriesCard); one that carries
+// The adapters arm every profile's endpoint. A request that is exactly a profile's card
+// request, its URL and its method (a POST, or Target Optical's PUT), pauses when it
+// carries a card (cardEndpointCarriesCard); one that carries
 // none, such as a stay paid with points or a card a processor's own fields tokenized,
 // is the merchant's own business and continues untouched. While this build's copy of
 // the profile does not take payments (observe, a fact only a partner HAR can pin, no
@@ -108,6 +109,18 @@ export function cardEndpointResendFor(url, method) {
         return null;
     }
 }
+// Every method a profile's card request or one of its resends is sent with (a POST, Target
+// Optical's PUT addPayment and PUT card save), from this build's own table.
+const ROUTED_METHODS = [...new Set(PROFILES.flatMap((profile) => [profile.method, ...(profile.resends ?? []).map((resend) => resend.method)]))];
+/**
+ * Whether a URL is any profile's card request or one of its resends, by any method the
+ * table names: the Playwright adapter's route filter, which sees the URL alone. The
+ * pre-claim gates then judge each routed request by its own method and body (a GET or a
+ * CORS preflight to the same URL defers), so routing a URL is never a decision to pause it.
+ */
+export function cardEndpointRouted(url) {
+    return ROUTED_METHODS.some((method) => cardEndpointFor(url, method) !== null || cardEndpointResendFor(url, method) !== null);
+}
 /** The origins of the profiles whose merchant keeps its own record of the order: the only responses card-endpoint-facts.ts records. */
 export function cardEndpointFactsOrigins() {
     return [...new Set(PROFILES.filter((profile) => profile.facts).map((profile) => profile.endpoint))];

package/dist/cdp.js

@@ -12,6 +12,7 @@ import { GMO_TOKEN_V1_PATTERNS, gmoRequestShop, isGmoTokenV1Request, recognizesG
 import { DatatransRepeats } from './datatrans.js';
 import { SHIJI_STS_COMPANION_WINDOW_MS, ShijiStsCompanions, ShijiStsError, isShijiStsHost, shijiStsTokenContinuation, } from './shiji-sts.js';
 import { isArmedEkashuUrl } from './ekashu.js';
+import { PAYPAL_HOSTED_FIELDS_PATTERNS, isPaypalHostedFieldsConfirm } from './paypal-hosted-fields.js';
 import { CheckoutAttachmentError, attachmentDeadline, attachmentFailure, withinAttachmentDeadline } from './attachment.js';
 import { cseBody } from './cse-body.js';
 import { STRIPE_SETUP_INTENT_CONFIRM, setupConfirmPayingWith } from './stripe-setup.js';
@@ -23,7 +24,7 @@ import { hostedFormSubmittedPage } from './hosted-form.js';
 import { amadeusSendWindowMs, armSendWindow, failsAsNetworkError } from './amadeus.js';
 import { CheckoutLifecycle, paymentEndpointGuards } from './lifecycle.js';
 import { CaptureContexts, MicroformFrames, judgeMicroformFrameUrls, loadedCardMicroformFromUrls, refusedRequestFailure, } from './cybersource-flex.js';
-import { CARD_ENDPOINT_REFUSED_STEP_ANSWER, CARD_ENDPOINT_WITHHELD_ANSWER, CardEndpointRefusedError, captureCardEndpointSession, cardEndpointAnswerHeaders, cardEndpointCookies, cardEndpointDetail, cardEndpointFor, cardEndpointNavigationAnswer, cardEndpointPatterns, cardEndpointResendFor, } from './card-endpoint.js';
+import { CARD_ENDPOINT_REFUSED_STEP_ANSWER, CARD_ENDPOINT_WITHHELD_ANSWER, CardEndpointRefusedError, captureCardEndpointSession, cardEndpointAnswerHeaders, cardEndpointCookies, cardEndpointDetail, cardEndpointNavigationAnswer, cardEndpointPatterns, cardEndpointRouted, } from './card-endpoint.js';
 import { CardEndpointFactsWatch } from './card-endpoint-facts.js';
 import { PAYRAILS_GUARD_PATTERNS, PAYRAILS_INIT_BODY_LIMIT, PayrailsSessionCapture, isPayrailsHost, payrailsInitCandidate, recognizesPayrails, } from './payrails.js';
 import { cardEndpointStoppedPage, refusedNavigationOutcome } from './card-endpoint-page.js';
@@ -621,13 +622,13 @@ export function withCorsHeaders(headers, cors) {
     return out;
 }
 /**
- * The request a card endpoint approval is asked for: `request` names the URL and
- * nothing else, and the profile travels with the captured session in
- * merchant_card_endpoint, the one member the API seals, with the merchant's own cut
- * record of the order for a profile that reads one.
+ * The request a card endpoint approval is asked for: `request` names the URL and the
+ * profile's own method and nothing else, and the profile travels with the captured
+ * session in merchant_card_endpoint, the one member the API seals, with the merchant's
+ * own cut record of the order for a profile that reads one.
  */
 function cardEndpointRequest(profile, session, facts = null) {
-    return { url: session.url, method: 'POST', headers: {}, body: '', merchant_card_endpoint: { profile: profile.id, session, ...(facts ? { facts } : {}) } };
+    return { url: session.url, method: profile.method, headers: {}, body: '', merchant_card_endpoint: { profile: profile.id, session, ...(facts ? { facts } : {}) } };
 }
 /**
  * The merchant's own record of the order for a paused card request of a profile that
@@ -1909,10 +1910,13 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
     // merchant, and a request with no card in it continues untouched.
     // Every Payrails host is intercepted only for an org the API served Payrails
     // to, so the gate can abort a card-form payment (see payrails.ts).
+    // PayPal's legacy Hosted Fields confirm is armed for every org, whatever the
+    // registry serves: one that carries the typed card is paused only to be
+    // refused, and one with no card continues (see paypal-hosted-fields.ts).
     const urlPatterns = [...new Set([...(derived.length > 0 ? derived : FALLBACK_CARD_PATTERNS), ...guards.patterns,
             ...(stripeCheckout.isEnabled() ? ['https://api.stripe.com/*'] : []), MERCADO_CHECKOUT_PATTERN, ...merchantPatterns,
             ...(recognizesGmo(opts.vault) ? GMO_TOKEN_V1_PATTERNS : []), ...juspayCheckout.urlPatterns(), ...cardEndpointPatterns(),
-            ...(payrails ? PAYRAILS_GUARD_PATTERNS : [])])];
+            ...(payrails ? PAYRAILS_GUARD_PATTERNS : []), ...PAYPAL_HOSTED_FIELDS_PATTERNS])];
     const arm = async (sessionId, resume = false, worker = false) => {
         const key = sessionId ?? '__root__';
         if (armed.has(key))
@@ -3173,17 +3177,19 @@ export async function attachToPlaywright(page, opts) {
             // GMO token v1's JSONP GET, routed only for an org the API served GMO to (see attachToCdp).
             || (isGmoTokenV1Request(url.toString()) && recognizesGmo(opts.vault))
             || juspayCheckout.matches(url.toString())
-            // Every reviewed card endpoint, in any status (the pre-claim gate holds only a request that carries a card,
-            // and refuses one this build does not pay).
-            || cardEndpointFor(url.toString(), 'POST') !== null
-            // A request that sends the typed card to such a merchant again, refused in every status.
-            || cardEndpointResendFor(url.toString(), 'POST') !== null
+            // Every reviewed card endpoint, in any status, and every request that sends the typed card to such a merchant
+            // again, by any method the table names (Target Optical's addPayment and card save are PUTs). The pre-claim
+            // gates hold only a card request that carries a card, refuse one this build does not pay, and refuse a resend
+            // in every status.
+            || cardEndpointRouted(url.toString())
             || aci.matches(url.toString())
             // Every Payrails host, routed only for an org the API served Payrails to (see attachToCdp).
             || (payrails !== null && isPayrailsHost(url.toString()))
             // Every request to an NMI host whose entry is served (ekashu.ts), as attachToCdp arms the
             // host: the card page's post and its 3-D Secure calls reach the NMI gate and fail.
-            || isArmedEkashuUrl(opts.vault, url.toString()), async (route) => {
+            || isArmedEkashuUrl(opts.vault, url.toString())
+            // PayPal's legacy Hosted Fields confirm, for every org, as attachToCdp arms it (paypal-hosted-fields.ts).
+            || isPaypalHostedFieldsConfirm(url.toString()), async (route) => {
             const request = route.request();
             // When this request paused, and the page it came from: the merchant's total is read as of now.
             const pausedAt = Date.now();