@agent-cards/sdk 0.23.2 → 0.23.4

package/dist/merchant-card-endpoints.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: d73edb25ace75651a72071180425f4e2b4717e5fd5504f2d2d336d70a55e0f64
+// artifact-sha256: 527edb8fd48229e7404d5fda8d1f8e243b5694c350eee105bec8815a0e848df0
 // src/json-path.js
 var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function isPlainObject(v) {
@@ -645,16 +645,47 @@ var NAVIGATION_HEADERS = /* @__PURE__ */ Object.freeze([
     "sec-fetch-user"
 ]);
 var GUARANTEE_RATES = "a policy for guarantee rates: the hotel charges the card at the stay, by when a single-use card may have closed";
+var ATT_SESSION = /* @__PURE__ */ deepFreeze({
+    cookies: true,
+    cookie_names: null,
+    // X-CSRF-TOKEN rides only when the page's sessionStorage holds csrf-token, which a guest checkout's does not.
+    headers: [...BROWSER_HEADERS, "content-type", "x-csrf-token", "appname", "idpctx-appname", "idp-source", "idpctx-source", "productsku"],
+    required: ["appname"]
+});
+var ATT_CARD = /* @__PURE__ */ deepFreeze({
+    pan: { at: ["cardNumber"], format: "digits" },
+    cvv: { at: ["cvv"], format: "digits" },
+    // The page writes the two-digit month, and '20' before the two digits of the year typed as mm/yy.
+    exp_month: { at: ["expDate"], format: "mm" },
+    exp_year: { at: ["expYear"], format: "yyyy" },
+    expiry: null,
+    last4: null,
+    leading: null,
+    // The page's brand reader (module 47170) also writes DINERS, which no reviewed map names, and '' for any other card.
+    brands: [{ at: ["cardSubType"], map: { visa: "VISA", mastercard: "MASTERCARD", amex: "AMEX", discover: "DISCOVER" } }],
+    bins: null
+});
+var ATT_REQUIRES = /* @__PURE__ */ deepFreeze([{ at: ["type"], one_of: ["creditcard", "debitcard"] }]);
+var ATT_REFUSE = /* @__PURE__ */ deepFreeze([
+    { at: ["savedPaymentData"], when: "present" },
+    { at: ["autoPayInfoList"], when: "present" },
+    { at: ["leaseId"], when: "present" },
+    // The Citi card state (module 43541), which the page copies into every body: null unless a Citi application ran.
+    { at: ["transactionId"], when: "nonempty" },
+    { at: ["statusCode"], when: "nonempty" },
+    { at: ["includeAutoPay"], when: "true" }
+]);
 var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
     {
         id: "att_payment_info",
         merchant: "AT&T",
         status: "observe",
         evidence: [
-            "att.com buy flow bundles (release/26.09.23.REL.COMMERCEUI), read Sep 25, 2026: with isUnifiedMfeEnabled on, Networker posts JSON with credentials: include to /msapi/checkoutexporch/v1/paymentInfo?cartId=<CHECKOUT_MFE_CART_ID>.",
-            "Headers: content-type application/json, appname and idpctx-appname onlinecart, X-CSRF-TOKEN from sessionStorage csrf-token.",
-            "Body: flat JSON with cardNumber, cvv, expDate (the month), expYear, name, zip, type, amount, cardSubType (the brand, derived from the PAN), and savedPaymentData, includeAutoPay, autoPayInfoList, leaseId, transactionId, statusCode on other flows.",
-            "The card-free order POST (/msapi/checkoutexporch/v1/post) carries the SMS PIN step-up."
+            "att.com buy flow bundles (Branch release/26.09.27.REL.HF.COMMERCEUI; the _app, purchaseorder, MFE.checkoutMFE and MFE.CheckoutPaymentInfo chunks byte-identical Sep 30, Oct 6 and Oct 7, 2026), read on the Payment step of a guest accessory checkout Oct 6: the URL builder (module 29882 PT) gives CHECKOUT_MFE_PAYMENT_URL /msapi/checkoutorch/v1/mfe/paymentInfo, with no query, when the cart answer names no cartType listed in meta expOrchCartType and meta useExpOrch is off; Networker posts JSON with credentials: include. Meta isOrderPathEnabled, off on Oct 7, would move the base under /msapi/order.",
+            "Headers: getDefaultHeaders (module 20076) writes accept-language, appname and idpctx-appname onlinecart, idp-source and idpctx-source NEW_WIRELESS, and productsku; it adds X-CSRF-TOKEN only from sessionStorage csrf-token, which a guest checkout does not hold (its customerInfo and deliveryInfo posts on the same base got 200 without one).",
+            'Body (module 67295): cardNumber, cvv, expDate (the two-digit month), expYear ("20" and the two digits typed), name, type (the selected method: creditcard by default, or debitcard), zip, amount (Number(dueToday).toFixed(2)), dueToday, paymentTerms, cardSubType (module 47170: VISA, MASTERCARD, AMEX, DISCOVER, DINERS, else empty), statusCode and transactionId (the Citi card state, module 43541: null unless a Citi application ran) and isTradeIn; leaseId with progressive leasing, savedPaymentData only in validate mode.',
+            "The card-free order POST (/msapi/checkoutorch/v1/mfe/post) may open a PIN, AUTHID or SafeGuard step and is re-posted after it; AT&T holds the funds at the order and charges the card when the order ships.",
+            "The card-on-file panel (MFE.CheckoutCardOnFilePanel, read Oct 7, 2026) posts the typed card number, code and expiry to /msapi/checkoutorch/v1/mfe/cardOnFile when the checkout lists a card-on-file step, which the guest accessory checkout did not: a resend."
         ],
         har: null,
         checkout: "https://www.att.com",
@@ -662,42 +693,20 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         frame: null,
         endpoint: "https://www.att.com",
         method: "POST",
-        path: "/msapi/checkoutexporch/v1/paymentInfo",
-        query: { cartId: ":cartId" },
+        path: "/msapi/checkoutorch/v1/mfe/paymentInfo",
+        query: {},
         navigation: null,
         encoding: "json",
-        session: {
-            cookies: true,
-            cookie_names: null,
-            headers: [...BROWSER_HEADERS, "content-type", "x-csrf-token", "appname", "idpctx-appname"],
-            required: ["x-csrf-token", "appname"]
-        },
-        card: {
-            pan: { at: ["cardNumber"], format: "digits" },
-            cvv: { at: ["cvv"], format: "digits" },
-            exp_month: { at: ["expDate"], format: "as_typed" },
-            exp_year: { at: ["expYear"], format: "as_typed" },
-            expiry: null,
-            last4: null,
-            leading: null,
-            brands: [{ at: ["cardSubType"], map: null }],
-            bins: null
-        },
+        session: ATT_SESSION,
+        card: ATT_CARD,
         merchant_key: null,
-        requires: [{ at: ["type"], one_of: ["CREDIT", "DEBIT", "ANYCARD"] }],
-        refuse: [
-            { at: ["savedPaymentData"], when: "present" },
-            { at: ["autoPayInfoList"], when: "present" },
-            { at: ["leaseId"], when: "present" },
-            { at: ["transactionId"], when: "present" },
-            { at: ["statusCode"], when: "present" },
-            { at: ["includeAutoPay"], when: "true" }
-        ],
+        requires: ATT_REQUIRES,
+        refuse: ATT_REFUSE,
         payment_method: null,
         amount: { at: ["amount"], kind: "decimal_string" },
         currency: "USD",
         response: { headers: ["content-type", "set-cookie", "x-csrf-token"], withhold: [] },
-        resends: [],
+        resends: [{ method: "POST", path: "/msapi/checkoutorch/v1/mfe/cardOnFile", query: {} }],
         challenge: null,
         facts: null,
         bootstrap: "/robots.txt",
@@ -705,9 +714,8 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         charge_timing: "deferred",
         once_per: null,
         pending: [
-            "card.brands: the cardSubType value for each brand",
-            "card.exp_month and card.exp_year: how many digits expDate and expYear carry",
-            "whether cartId also rides in the body"
+            "the paymentInfo answer: its status, body and headers (only the sibling MFE answers were seen)",
+            "paymentTerms.paymentEventType: the value a one-time purchase sends, pinned by a requires rule"
         ]
     },
     {
@@ -715,9 +723,10 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         merchant: "Italo",
         status: "observe",
         evidence: [
-            "biglietti.italotreno.com public bundles (API client chunk 901970b7, payment step chunk 6297), read Sep 25, 2026: axios posts JSON, without withCredentials, to https://api-biglietti.italotreno.com/api/v1/booking/{bookingId}/payments/credit-card.",
+            "biglietti.italotreno.com public bundles, read Sep 25, 2026 (API client chunk 901970b7, payment step chunk 6297), and the same code read live Sep 30 and Oct 6, 2026 (API client chunk 9d3fb9db-25fa9aa33ff5588f, payment step chunk 76297-bb161301521c29cc, the same bytes on both days): axios posts JSON, without withCredentials, to https://api-biglietti.italotreno.com/api/v1/booking/{bookingId}/payments/credit-card.",
             "Headers: Content-Type application/json, Authorization Bearer <BIGSessionToken>, X-BIG-working-session-id.",
-            "Body: accountName, accountNumber (PAN, spaces stripped), CVV, expirationMonth (two-digit string), expirationYear (four-digit number), termsAndConditions true, StoreCreditCard (saves the card), creditCardId (saved cards), paymentMethodCode (VI, MC, AX, DC, JC, OT from payment.fns.cardType).",
+            "Body: accountName, accountNumber (PAN, spaces stripped), CVV, expirationMonth (two-digit string), expirationYear (four-digit number), termsAndConditions true, StoreCreditCard (false in a guest's body: the box that saves the card shows only to a signed-in user), paymentMethodCode (payment.fns.cardType: VI, MC, AX, DC for Discover, JC for JCB; a card type the table does not name, such as Visa Electron, leaves it out). A saved card posts {creditCardId, cvv} to /payments/registered-credit-card instead, so a creditCardId here is refused.",
+            "The payment step builds the body with expire: undefined, which JSON.stringify drops, so the body never carries expire (live checks of Sep 30 and Oct 6, 2026); a body that sends it as null passes the rules too.",
             "The answer carries validationMetadata.PaReq, a Nexi 3DS HTML snippet the page injects; the 3DS return and the commit are card-free."
         ],
         har: null,
@@ -765,8 +774,7 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         charge_timing: "at_request",
         once_per: null,
         pending: [
-            "whether the validationMetadata.PaReq answer carries the card number",
-            "whether expire is sent absent or as null"
+            "whether the validationMetadata.PaReq answer carries the card number"
         ]
     },
     {
@@ -774,18 +782,21 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         merchant: "Universal Orlando Resort",
         status: "observe",
         evidence: [
-            "www.universalorlando.com/web-store bundle (main-YEGFGVHU.js payCard and buildPaymentUrl), read Sep 25, 2026: Angular HttpClient posts JSON, without withCredentials, to https://secure-api.universalparks.com/instances/{instance-id}/commerce-checkout for a guest checkout.",
-            "Headers: Authorization Bearer, X-IBM-Client-ID, WCToken, WCTrustedToken, x-instance-id, x-resort-area-code, x-source-Id, X-UNIWebService-ApiKey, -AppVersion, -Device, -Platform, Akamai-BM-Telemetry.",
-            "Body: order_id, currency_code USD, amount (a string), number, cvv, expiration {month, year} as integers, save_to_wallet, cardinal-3d-secure {reference_id, jwt, window_size}, billing and contact fields.",
-            "A Cardinal challenge answers 400 CARDINAL_3DS_MORE_INFO_REQUIRED and re-posts the card with the Cardinal jwt, which the refuse rules stop."
+            "store.universalorlando.com, the SAP Commerce Spartacus store (OCC base site uor_b2c) that www.universalorlando.com/web-store answers 301 to: main-CS3EMKUE.js read Sep 30 and Oct 6, 2026, and Universal's next build, main-BL5KQYHU.js (sha256 f41d4727), read Oct 7 and 8, 2026. For a guest, anonymousPreCheckout posts JSON with Angular HttpClient, without withCredentials, to https://secure-api.universalparks.com/instances/{InteractGuestId}/carts/{cart guid}/precheckout.",
+            "Headers (getUdxAuthHeaders): Authorization Bearer (the guest token the page minted), x-source-id, x-instance-id (the InteractGuestId, left out when the page holds none), x-resort-area-code uor, x-uniwebservice-apikey and cart-id (the cart guid again); Angular adds Content-Type application/json, and udx-bmak.js (sha256 b33ecc47) adds Akamai-BM-Telemetry to a URL ending in /precheckout. No cookie, WCToken, WCTrustedToken or X-IBM-Client-ID.",
+            'Body (buildPreCheckoutPayload): base_site_id, user_id ("anonymous" for a guest, the customer id when signed in), billing_address, email_address, phone_number {number}, then card {expiration {month, year} as integers, first_name_on_card, last_name_on_card, number, cvv, save_card}, or card_id for a saved card, then the Accertify device_id and uba. No amount, currency or order id: Universal prices the cart on its own server (USD 21.29 for the 1-Day Coca-Cola Freestyle Souvenir Cup on Oct 6, 2026, live-checks-oct6/universal_orlando).',
+            "On a 200 the page places the order itself with a card-free call, POST comm-api.universaldestinationsandexperiences.com/occ/v2/uor_b2c/users/anonymous/orders?cartId={cart guid}. No client-side 3-D Secure runs: the Cardinal step sits behind isCardinalTokenFeatureEnabled, which stays false.",
+            "Two other requests on the same host carry the typed card, and resends below lists both: a signed-in checkout posts the same body to /guests/{guest id}/carts/{cart guid}/precheckout, and the Cardinal step, if Universal turns it on, posts {number} to /resort-areas/uor/carts/{cart guid}/cardinal-token.",
+            "The retired web-store checkout still loads from a deep link: www.universalorlando.com/web-store/en/us/cart and /web-store/en/us/checkout answered 200 with its app, main-YEGFGVHU.js (sha256 0a535713), on Oct 8, 2026, and nothing in that app sends the page on to the new store. Its payCard posts the typed card to /instances/{instance id}/commerce-checkout for a guest (the request this profile pinned until the store moved) and to /guests/{guest id}/commerce-checkout when signed in, so resends below lists both as well.",
+            "GET https://secure-api.universalparks.com/robots.txt answers 404 text/plain from a KrakenD gateway behind Akamai (Oct 7 and 8, 2026), which the transport takes: it refuses only a bootstrap answer of 500 or more."
         ],
         har: null,
-        checkout: "https://www.universalorlando.com",
+        checkout: "https://store.universalorlando.com",
         checkout_frame: false,
         frame: null,
         endpoint: "https://secure-api.universalparks.com",
         method: "POST",
-        path: "/instances/:instanceId/commerce-checkout",
+        path: "/instances/:instanceId/carts/:cartId/precheckout",
         query: {},
         navigation: null,
         encoding: "json",
@@ -796,25 +807,20 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
                 ...BROWSER_HEADERS,
                 "content-type",
                 "authorization",
-                "x-ibm-client-id",
-                "wctoken",
-                "wctrustedtoken",
                 "x-instance-id",
                 "x-resort-area-code",
                 "x-source-id",
                 "x-uniwebservice-apikey",
-                "x-uniwebservice-appversion",
-                "x-uniwebservice-device",
-                "x-uniwebservice-platform",
+                "cart-id",
                 "akamai-bm-telemetry"
             ],
-            required: ["authorization", "x-ibm-client-id", "wctoken", "wctrustedtoken"]
+            required: ["authorization", "x-instance-id", "cart-id"]
         },
         card: {
-            pan: { at: ["number"], format: "digits" },
-            cvv: { at: ["cvv"], format: "digits" },
-            exp_month: { at: ["expiration", "month"], format: "m_int" },
-            exp_year: { at: ["expiration", "year"], format: "yyyy_int" },
+            pan: { at: ["card", "number"], format: "digits" },
+            cvv: { at: ["card", "cvv"], format: "digits" },
+            exp_month: { at: ["card", "expiration", "month"], format: "m_int" },
+            exp_year: { at: ["card", "expiration", "year"], format: "yyyy_int" },
             expiry: null,
             last4: null,
             leading: null,
@@ -822,79 +828,108 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
             bins: null
         },
         merchant_key: null,
+        // A guest's order on Universal Orlando's own store: a signed-in customer's id or another base site is not this checkout.
         requires: [
-            { at: ["currency_code"], equals: "USD" },
-            { at: ["order_id"], present: true }
+            { at: ["user_id"], equals: "anonymous" },
+            { at: ["base_site_id"], equals: "uor_b2c" }
         ],
         refuse: [
-            { at: ["save_to_wallet"], when: "true" },
-            { at: ["cardinal-3d-secure", "jwt"], when: "nonempty" },
-            { at: ["cardinal-3d-secure", "reference_id"], when: "nonempty" }
+            { at: ["card", "save_card"], when: "true" },
+            { at: ["card_id"], when: "present" }
         ],
         payment_method: null,
-        amount: { at: ["amount"], kind: "decimal_string" },
-        currency: { at: ["currency_code"] },
+        // The body names no amount: Universal charges the cart its server priced, and the agent's amount is the only one checked.
+        amount: null,
+        currency: "USD",
         response: { headers: ["content-type"], withhold: [] },
-        resends: [],
+        // The other posts of the typed card on this host (evidence above), from the store and from the retired
+        // web-store checkout that still loads: an approval never covers them.
+        resends: [
+            { method: "POST", path: "/guests/:guestId/carts/:cartId/precheckout", query: {} },
+            { method: "POST", path: "/resort-areas/uor/carts/:cartId/cardinal-token", query: {} },
+            { method: "POST", path: "/instances/:instanceId/commerce-checkout", query: {} },
+            { method: "POST", path: "/guests/:guestId/commerce-checkout", query: {} }
+        ],
         challenge: null,
         facts: null,
         bootstrap: "/robots.txt",
         timeout_ms: 3e4,
-        charge_timing: "at_request",
-        once_per: null,
-        pending: ["how long a captured akamai-bm-telemetry header stays accepted"]
+        charge_timing: "deferred",
+        // The cart guid names the checkout, so the API lets one cart take one payment at a time.
+        once_per: { path: "cartId" },
+        pending: [
+            "what precheckout answers, and whether it authorizes the card (at_request) or the card-free order the page places after it does (deferred)",
+            "how long the guest bearer token lives after the page mints it",
+            "the Akamai-BM-Telemetry value the page sends on precheckout (sensor data or missing-telemetry), and how long a captured one stays accepted"
+        ]
     },
     {
         id: "target_optical_pi_add",
         merchant: "Target Optical",
         status: "observe",
         evidence: [
-            "www.targetoptical.com HCL Commerce storefront scripts (CheckoutPayments.populateProtocolData, wc.service.invoke over $.ajax), read Sep 25, 2026: a same-origin form POST to /AjaxOrderChangeServicePIAddTO with X-Requested-With XMLHttpRequest and the WCS and Akamai cookies.",
-            "Body: storeId, catalogId, langId, payMethodId (brand code), piAmount (order total), billing_address_id, account (the PAN), cc_cvc, expire_month, expire_year, cc_brand, cc_nameoncard, requesttype ajax, authToken (WCS anti-CSRF), forterToken; saveCreditCard=on or creditCardToUse for a saved card.",
-            "The card is checked or authorized at this step; the later PIUpdate, OrderPrepare and SubmitOrder calls are card-free."
+            "www.targetoptical.com headless checkout (components.targetoptical.com/to-headless-checkout/prod/v1.65.0/dist/to-checkout.js, sha256 78425e43966143926e96b27f26114868074ba8f004ac368ef648f4dfd964f913), read Sep 30 and Oct 6, 2026: axios 0.24.0 sends PUT https://www.targetoptical.com/wcs/resources/store/12001/cart/@self/addPayment?nocache=<Date.now()> with a plain JSON object and withCredentials, and sets no header of its own (accept and content-type application/json only, seen live on its updateShipping sibling; no X-Requested-With).",
+            'Guest new-card body, in order: storeId 12001, valueFromProfileOrder, valueFromPaymentTC, paymentTCId, payMethodId, piAmount (the cart grandTotal with five decimals, "49.42000"), calculationUsage, customerWebId (empty), billing_address_id, cc_brand, cc_cvc, account (the PAN, dashes removed), expire_month (MM), expire_year (YYYY) from the month picker, check_routing_number, checkingAccountNumber, checkRoutingNumber (empty), forterToken, reCaptchaToken (empty: reCAPTCHA is off), checkWarranty; orderId only in a CSR on-behalf session.',
+            "Brand codes: cc_brand Visa, Mastercard, Amex, Discover from the bundle's own card type table, and payMethodId VISA, Master Card, AMEX, Discover from window.cardTypePayMethodMapping; any other number, a 2-series Mastercard included, posts generic and CyberSource.",
+            "A saved card sends creditCardToUse, requesttype and authToken to the same URL with no card. A signed-in shopper who ticks Save also sends the typed card to PUT /wcs/resources/store/12001/mypayments in parallel. The same click then sends prepareOrder and the order submit, both card-free.",
+            "The older HCL checkout posted the card as a form to POST /AjaxOrderChangeServicePIAddTO (read Sep 25), which ShippingAndBillingServicesDeclaration.min.js declares; the storefront still serves that script (Aug 20) but did not load it on Oct 6."
         ],
         har: null,
         checkout: "https://www.targetoptical.com",
         checkout_frame: false,
         frame: null,
         endpoint: "https://www.targetoptical.com",
-        method: "POST",
-        path: "/AjaxOrderChangeServicePIAddTO",
-        query: {},
+        method: "PUT",
+        path: "/wcs/resources/store/12001/cart/@self/addPayment",
+        query: { nocache: ":nocache" },
         navigation: null,
-        encoding: "form",
+        encoding: "json",
         session: {
             cookies: true,
             cookie_names: null,
-            headers: [...BROWSER_HEADERS, "content-type", "x-requested-with"],
-            required: ["x-requested-with"]
+            headers: [...BROWSER_HEADERS, "content-type"],
+            required: []
         },
         card: {
-            pan: { at: "account", format: "digits" },
-            cvv: { at: "cc_cvc", format: "digits" },
-            exp_month: { at: "expire_month", format: "as_typed" },
-            exp_year: { at: "expire_year", format: "as_typed" },
+            pan: { at: ["account"], format: "digits" },
+            cvv: { at: ["cc_cvc"], format: "digits" },
+            exp_month: { at: ["expire_month"], format: "mm" },
+            exp_year: { at: ["expire_year"], format: "yyyy" },
             expiry: null,
             last4: null,
             leading: null,
-            brands: [{ at: "cc_brand", map: null }, { at: "payMethodId", map: null }],
-            bins: null
+            brands: [
+                { at: ["cc_brand"], map: { visa: "Visa", mastercard: "Mastercard", amex: "Amex", discover: "Discover" } },
+                { at: ["payMethodId"], map: { visa: "VISA", mastercard: "Master Card", amex: "AMEX", discover: "Discover" } }
+            ],
+            // The page posts a 2-series Mastercard as generic and CyberSource, which no map names.
+            bins: { mastercard: ["51", "52", "53", "54", "55"] }
         },
         merchant_key: null,
         requires: [
-            { at: "requesttype", equals: "ajax" },
-            { at: "authToken", present: true },
-            { at: "piAmount", present: true }
+            { at: ["storeId"], equals: "12001" },
+            { at: ["billing_address_id"], present: true },
+            { at: ["piAmount"], present: true }
         ],
         refuse: [
-            { at: "saveCreditCard", when: "present" },
-            { at: "creditCardToUse", when: "present" }
+            { at: ["creditCardToUse"], when: "present" },
+            { at: ["saveCreditCard"], when: "present" },
+            // orderId and a customerWebId mark a CSR placing the order on a shopper's behalf.
+            { at: ["orderId"], when: "present" },
+            { at: ["customerWebId"], when: "nonempty" },
+            { at: ["checkingAccountNumber"], when: "nonempty" }
         ],
         payment_method: null,
-        amount: { at: "piAmount", kind: "decimal_string" },
+        amount: { at: ["piAmount"], kind: "decimal_string_scale5" },
         currency: "USD",
         response: { headers: ["content-type", "set-cookie"], withhold: [] },
-        resends: [],
+        resends: [
+            // The card save a signed-in shopper ticks, sent beside addPayment.
+            { method: "PUT", path: "/wcs/resources/store/12001/mypayments", query: { nocache: ":nocache" } },
+            // The form endpoint the older checkout posted the card to, which this profile paused until the headless
+            // checkout replaced it: a post there is aborted in every status, never left to reach the merchant.
+            { method: "POST", path: "/AjaxOrderChangeServicePIAddTO", query: {} }
+        ],
         challenge: null,
         facts: null,
         bootstrap: "/robots.txt",
@@ -902,9 +937,8 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         charge_timing: "deferred",
         once_per: null,
         pending: [
-            "card.brands: the cc_brand and payMethodId values for each brand",
-            "card.exp_month and card.exp_year: how many digits expire_month and expire_year carry",
-            "whether the visible account1_1 field is also sent"
+            "the answer to addPayment: status, body and headers, and whether it asks the page for another step",
+            "which call authorizes the card, and whether the charge when the order ships needs the card to stay open"
         ]
     },
     {
@@ -1044,12 +1078,15 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         merchant: "Hilton",
         status: "observe",
         evidence: [
-            "Hilton's reservation app dx-res-ui (www.hilton.com/dx_reservation_app): payment page chunks 70b8777e (Aug 24) and 8a158c4c (Sep 8), _app 6b38675c and c2e248fe (Sep 15), read from archive.org copies Sep 25, 2026. Every Hilton brand property books through it, Hilton San Francisco Union Square (SFOFHHH) included.",
+            "Hilton's reservation app dx-res-ui (www.hilton.com/dx_reservation_app): payment page chunks 70b8777e (Aug 24) and 8a158c4c (Sep 8), _app 6b38675c and c2e248fe (Sep 15), read from archive.org copies Sep 25, 2026, and the live Turbopack build dx-res-ui:1080995 (deployed Oct 5, 2026), read Oct 6, 2026 (live-checks-oct6/hilton_union_square), which runs the same code paths. Every Hilton brand property books through it, Hilton San Francisco Union Square (SFOFHHH) included.",
             "The GraphQL transport fetches POST ${DX_GRAPHQL_CLIENT_URI}?${new URLSearchParams({appName, appVersion, operationName, originalOpName, bl})} with body JSON.stringify({query, operationName, variables}): https://www.hilton.com/graphql/customer, appVersion dx-res-ui:<build>, which URLSearchParams writes as dx-res-ui%3A<build>.",
             "Headers: Content-Type application/json, dx-platform (web when the page sets none), visitorid, hltclientmessageid, and Authorization Bearer only when there is no webGuestMetadata cookie; a same-origin fetch, so the first-party cookies go with it.",
             "createReservation variables: {language, input: {totalAmountAfterTax (a number), currencyCode, guarantee: {guarMethodCode, paymentCard: {cardCode (from the typed digits), cardExpireDate, cardNumber, cvvString (only when the rate sets cvvRequired), cardholder fields, paymentId (a saved Honors card)}, deposit}, ...}, scaInput, mfaInput, enrollment, guestUpdate: {preferredAddress, updatePaymentMethod (saves the card to the account)}}.",
             "SCA (PSD2 or Adyen Protect) sends scaInput {returnUrl, browserInfo} on the first call, answers error 897 and sends createReservation again with {scaId, md, paRes} and the card; MFA (errors 995, 996) sends it again with mfaInput. Both are refused here, so only stays that need neither are paid.",
-            "The body's query is the createReservation operationString with its two fragments, which the transport sends unchanged (z = {query, operationName, variables}). requires pins it to the text the archived Sep 15 _app chunk c2e248fe builds (merchant-card-endpoint-documents.js), so an argument written inline in the document or a second createReservation under an alias is refused."
+            "The body's query is the createReservation operationString with its two fragments, which the transport sends unchanged (z = {query, operationName, variables}). requires pins it to the text the archived Sep 15 _app chunk c2e248fe builds (merchant-card-endpoint-documents.js), so an argument written inline in the document or a second createReservation under an alias is refused. The live build of Oct 5 sends that text byte for byte (9932 characters, SHA-256 93d99a00b4447bc24dec69aa09434131a51c454a5eae813a4d95fc10d540c4e6, read Oct 6, 2026).",
+            "Read live Oct 6, 2026: the month (01 to 12) and two-digit year (26 to 35) selects write cardExpireDate as MMYY, which as_typed reads. cardCode comes from the typed digits (visa VI, mastercard MC, americanexpress AX, discover and elo DS, dinersclub DC, jcb JC, maestro SW, unionpay CU), and the map pays the four networks a review takes. On bl=en the URL carries nothing beyond the reviewed query: language rides it only on a OneLink locale, and ctyhocn, the one variable the app copies into URLs, is no top-level createReservation variable.",
+            "Rates read live Oct 6, 2026 for a guest at Hilton San Francisco Union Square, Oct 23 to 24: the prepaid Non-refundable rate QO is guarMethodCode FP with depositRequired and a deposit of the whole stay (192.05 USD), 'your credit card will be charged immediately', and the page sends guarantee.deposit {amount}; the Semi-Flex rate R3X is a CC guarantee with deposit null, charged at the stay. A hotel is paid only at a prepaid rate (Felipe's rule, Oct 7, 2026): requires takes guarMethodCode FP with a deposit amount, which refuses R3X and every other guarantee, and an FP rate is charged at the request.",
+            "Every guest rate priced that day set scaRequired with scaType protect before any card or identity was typed, so the first createReservation at this hotel carries scaInput {returnUrl, browserInfo}, which the rules refuse until an SCA continuation exists. Join Hilton Honors for free is pre-ticked and enrolls the guest with no password: createReservation then carries variables.enrollment {sourceCode CPOH}, which opens an account, so a nonempty enrollment is refused."
         ],
         har: null,
         checkout: "https://www.hilton.com",
@@ -1075,19 +1112,22 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
             expiry: { at: ["variables", "input", "guarantee", "paymentCard", "cardExpireDate"], format: "as_typed" },
             last4: null,
             leading: null,
-            brands: [{ at: ["variables", "input", "guarantee", "paymentCard", "cardCode"], map: null }],
+            brands: [{ at: ["variables", "input", "guarantee", "paymentCard", "cardCode"], map: { visa: "VI", mastercard: "MC", amex: "AX", discover: "DS" } }],
             bins: null
         },
         merchant_key: null,
         requires: [
             { at: ["operationName"], equals: "createReservation" },
-            { at: ["query"], one_of: [...HILTON_CREATE_RESERVATION_DOCUMENTS] }
+            { at: ["query"], one_of: [...HILTON_CREATE_RESERVATION_DOCUMENTS] },
+            { at: ["variables", "input", "guarantee", "guarMethodCode"], equals: "FP" },
+            { at: ["variables", "input", "guarantee", "deposit", "amount"], present: true }
         ],
         refuse: [
             { at: ["variables", "input", "guarantee", "paymentCard", "paymentId"], when: "present" },
             { at: ["variables", "scaInput"], when: "nonempty" },
             { at: ["variables", "mfaInput"], when: "nonempty" },
-            { at: ["variables", "guestUpdate", "updatePaymentMethod"], when: "true" }
+            { at: ["variables", "guestUpdate", "updatePaymentMethod"], when: "true" },
+            { at: ["variables", "enrollment"], when: "nonempty" }
         ],
         payment_method: null,
         amount: { at: ["variables", "input", "totalAmountAfterTax"], kind: "decimal_number" },
@@ -1098,14 +1138,10 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         facts: null,
         bootstrap: "/robots.txt",
         timeout_ms: 3e4,
-        charge_timing: "deferred",
+        charge_timing: "at_request",
         once_per: null,
         pending: [
-            "card.expiry: the form cardExpireDate is sent in",
-            "card.brands: the cardCode value for each brand",
-            "the query: whether createReservation adds language or other variables to it",
-            "the createReservation GraphQL document the live build sends, which requires pins (it holds the archived Sep 15 build's): a document that is not pinned can inline guestUpdate.updatePaymentMethod, scaInput or mfaInput, or alias createReservation twice",
-            GUARANTEE_RATES
+            "an SCA continuation: every guest rate priced at Hilton San Francisco Union Square on Oct 6, 2026 asked for SCA, so its first createReservation carries the scaInput refused here; paying such a stay needs the two scaInput shapes pinned, the 897 answer back on the page, the second createReservation that sends the card again, and the issuer challenge with the cardholder away"
         ]
     },
     {
@@ -1119,7 +1155,10 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
             `pay-ng v14.149.0, read live Oct 6, 2026 (live-checks-oct6/ihg): neither US hotel checked (AMAEH, AMARS) shows a security code field, and the page writes cvvNumber {token: ""} for each. The form asks for a code for points plus cash, and for a paid offer at Iberostar or at a hotel whose policy sets isCreditCardCVVRequired or isPaymentServiceInformationRequired; otherwise it keeps its code empty. So card.cvv is digits_if_asked, as Hilton's and SynXis' are: the rules leave an empty code empty and still read a code the hotel asks for as digits.`,
             "Headers: x-ihg-api-key (public client key), content-type application/json; charset=UTF-8, ihg-language, X-IHG-SSO-TOKEN, x-accept-currency (USD), IHG-SellSource, Forter-Token; interceptors add IHG-SessionId and IHG-TransactionId.",
             "Hotels that set isPaymentServiceInformationRequired first send the PAN to /payments/threedsecure/v1/token ({cardToken: <PAN>, cardType}) and /paymentSetup (card.token: <PAN>) and put the result in 3dsData, which is refused here; China UnionPay and PayPal set cupTokenId and paymentSource, also refused. Both 3-D Secure posts are in resends below.",
-            'pay-ng v14.149.0, read live Oct 6, 2026 (live-checks-oct6/ihg): the pay page posts the same reservation body, card in the clear, to /channels/direct/quickEnroll/v8/hotelReservations while its pre-ticked "Enroll for free as you book" box stays ticked (/quickEnroll/v9/hotelReservations behind the shouldUseNewQuickEnrolV9 flag, /quickEnroll/v8/multiRoomReservation for a cart), and to /reservations/v3/hotels/rooms/fromCart for more than one room, /reservations/v3/hotels/rooms/agent/reservations for a travel agent and /reservations/v3/businessRewardReservations for Business Rewards. Each is in resends below, so the SDK aborts it in every status.'
+            'pay-ng v14.149.0, read live Oct 6, 2026 (live-checks-oct6/ihg): the pay page posts the same reservation body, card in the clear, to /channels/direct/quickEnroll/v8/hotelReservations while its pre-ticked "Enroll for free as you book" box stays ticked (/quickEnroll/v9/hotelReservations behind the shouldUseNewQuickEnrolV9 flag, /quickEnroll/v8/multiRoomReservation for a cart), and to /reservations/v3/hotels/rooms/fromCart for more than one room, /reservations/v3/hotels/rooms/agent/reservations for a travel agent and /reservations/v3/businessRewardReservations for Business Rewards. Each is in resends below, so the SDK aborts it in every status.',
+            "The same read: cardCode comes from the typed digits, VS Visa, MC Mastercard, AX Amex, DS Discover, and DC, JC, CB, EC, BE and CU for the networks the map leaves out, so a card of those is refused. The expiry selects offer months 01 to 12 and years 26 to 45, so expireDate is always MMYY.",
+            "getHotel writes hotels[0] as {hotelMnemonic}, plus bookingCurrency, the shopper's currency, only when it differs from the hotel's own, which the body never names, so any bookingCurrency is refused. A hotel outside the US booked in its own currency sends none, so the body never shows that hotel charging in a currency other than the USD this profile names. setReservationRequestOffer writes segments[0].offer as {ratePlanTypeCode 'SR', productUses, ratePlanCode} for a public rate, and as {groupContractCode, ratePlanTypeCode, productUses} with no ratePlanCode for a group rate (pay-ng v14.144.1 chunk 7U5FHKAZ; v14.149.0 builds the same body).",
+            "Rates read live Oct 6, 2026 at two Amarillo hotels: Book Early & Save (IDAPF, Yellow City Studios AMAEH) is non-refundable, 'A deposit for the entire stay is due at time of booking'; Best Flexible Rate (IGCOR, Holiday Inn Amarillo West Medical Center AMARS) says 'You pay nothing today. A card simply holds your reservation.' A hotel is paid only at a prepaid rate (Felipe's rule, Oct 7, 2026): requires takes ratePlanCode IDAPF only, which refuses IGCOR, a group rate and every code whose terms no review read."
         ],
         har: null,
         checkout: "https://www.ihg.com",
@@ -1156,18 +1195,20 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
             expiry: { at: ["segments", 0, "payment", "paymentInformation", "paymentCard", "expireDate"], format: "mmyy" },
             last4: null,
             leading: null,
-            brands: [{ at: ["segments", 0, "payment", "paymentInformation", "paymentCard", "cardCode"], map: null }],
+            brands: [{ at: ["segments", 0, "payment", "paymentInformation", "paymentCard", "cardCode"], map: { visa: "VS", mastercard: "MC", amex: "AX", discover: "DS" } }],
             bins: null
         },
         merchant_key: null,
         requires: [
             { at: ["imageStatus"], equals: "COMMIT" },
-            { at: ["segments", 0, "payment", "guaranteeType"], equals: "STANDARD_GUARANTEE" }
+            { at: ["segments", 0, "payment", "guaranteeType"], equals: "STANDARD_GUARANTEE" },
+            { at: ["segments", 0, "offer", "ratePlanCode"], one_of: ["IDAPF"] }
         ],
         refuse: [
             { at: ["segments", 0, "payment", "paymentInformation", "paymentCard", "3dsData"], when: "present" },
             { at: ["segments", 0, "payment", "paymentInformation", "cupTokenId"], when: "present" },
-            { at: ["segments", 0, "payment", "paymentInformation", "paymentSource"], when: "present" }
+            { at: ["segments", 0, "payment", "paymentInformation", "paymentSource"], when: "present" },
+            { at: ["hotels", 0, "bookingCurrency"], when: "present" }
         ],
         payment_method: null,
         amount: null,
@@ -1190,12 +1231,7 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         timeout_ms: 3e4,
         charge_timing: "deferred",
         once_per: null,
-        pending: [
-            "card.brands: the cardCode value for each brand",
-            "card.expiry: that expirationMonth is always two digits, so expireDate is MMYY",
-            "the currency: a hotel outside the US charges in its own, which the body names only as hotels[0].bookingCurrency when it differs from the shopper's",
-            GUARANTEE_RATES
-        ]
+        pending: []
     },
     {
         id: "aa_process_payment",
@@ -1331,7 +1367,9 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
             "The confirm loop sends each room through route updateReservation: POST https://be.synxis.com/gw/itinerary/v1/updateReservation, Content-Type application/json; charset=utf-8, Accept application/json,application/x-javascript, Context BE, Accept-Language, ActivityID (sbeSessionID), Authorization only for a signed-in member, credentials include (apisession, sbeSessionID, Imperva and AWSALB cookies).",
             'Body: {version, Chain: {id}, Reservation: {action "Confirmed", Hotel: {id}, GuestList: [{Role "Primary", PaymentList: [{role "Primary", type "CreditCard", PaymentCard: {cardCode (VI, MC, AX, DS...), cardNumber, cardSecurityCode, expireDate "MM/YY", cardHolder}}], ...}], ...}, Source: {BrowserDetails}}; the expiry input is masked 99/99.',
             "The hotel's configuration shows no cvvCode field, so cardSecurityCode is sent empty; a later room sends the PaymentToken SynXis returned, and a PSD2 hotel sends consentToStoreCardData, both refused here.",
-            "A RedirectHtml answer with VendorStatus Redirected sends the page through a vendor or 3DS step and then itinerary/v2/ReservationPaymentCallback, with no card."
+            "A RedirectHtml answer with VendorStatus Redirected sends the page through a vendor or 3DS step and then itinerary/v2/ReservationPaymentCallback, with no card.",
+            "SynXis build 721fa2f4a19d8fde7485 (Sep 28, 2026), read live Oct 6, 2026 (live-checks-oct6/the_verb_hotel): the same card path, re-transpiled. The confirm builder writes the primary guest first in GuestList and the card first in its PaymentList, loyalty points after it, which requires pins; and RoomStay as {redeemLoyalty, payNow, startDate, endDate, GuestCount, NumRooms, RateList: [{code, primary: true}], Room: {code}, RoomRequestList}.",
+            "Rates read the same day for Dec 6 to 7, 2026: Non-Refundable (14DAYAP) is policy DP, GuaranteeLevel Deposit, 'Full prepayment of room and tax', a DepositFee of 100% of the stay before tax due AtTimeOfBooking with IsPrePayment, and AmountPayAtProperty 0. The page takes no payment itself, so SynXis or the hotel charges after the request, outside the page; it shows a 134.10 USD deposit (the room before tax) due now beside AmountPayableNow 202.74 USD, and which of the two posts at booking is the recorded purchase's to show. The Best Available Rate takes no deposit and only holds the card. Both send RoomStay.payNow false, so the body names only the rate code. A hotel is paid only at a prepaid rate (Felipe's rule, Oct 7, 2026): requires takes RateList[0].code 14DAYAP only, which refuses the Best Available Rate and every code whose terms no review read."
         ],
         har: null,
         checkout: "https://be.synxis.com",
@@ -1366,7 +1404,8 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
             { at: ["Reservation", "Hotel", "id"], one_of: [61148, "61148"] },
             { at: ["Reservation", "action"], equals: "Confirmed" },
             { at: ["Reservation", "GuestList", 0, "Role"], equals: "Primary" },
-            { at: ["Reservation", "GuestList", 0, "PaymentList", 0, "type"], equals: "CreditCard" }
+            { at: ["Reservation", "GuestList", 0, "PaymentList", 0, "type"], equals: "CreditCard" },
+            { at: ["Reservation", "RoomStay", "RateList", 0, "code"], one_of: ["14DAYAP"] }
         ],
         refuse: [
             { at: ["Reservation", "GuestList", 0, "PaymentList", 0, "PaymentCard", "PaymentToken"], when: "nonempty" },
@@ -1385,11 +1424,7 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         timeout_ms: 3e4,
         charge_timing: "deferred",
         once_per: null,
-        pending: [
-            "that the primary guest is GuestList[0] and its card PaymentList[0]",
-            "whether the hotel's rates take a deposit at booking or only hold the card",
-            GUARANTEE_RATES
-        ]
+        pending: []
     },
     {
         id: "runsignup_register_pay",
@@ -2071,7 +2106,8 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
             "The card frame, PciCardForm (archive.org 2026-07-06, 2026-07-23 and 2026-09-04), posts form action /validate/<session uuid>/Default natively, as a navigation of the iframe: hidden Id (the same uuid), CardNumber (maxlength 22), Month (1 to 12, no leading zero), Year (four digits), Cvv (maxlength 4) and CardHolderName. No processor SDK in the frame; D-EDGE charges from its own servers (WSPay for this hotel, by its terms).",
             "The frame also posts the first 8 characters of CardNumber as the field holds them (7 digits and a space once it groups a Visa or Mastercard number) to /cardCss/<session uuid>/Default to pick the card logo, which carries no full card and is not this request.",
             "secure-hotel-booking.com sits behind DataDome. The same card frame serves every D-EDGE hotel, so the profile names D-EDGE rather than one hotel; its currency is HUMA's.",
-            "HUMA's own payment step, read live Oct 6, 2026 (live-checks-oct6/huma_kotor_bay): the frame's cleanCardNumber rewrites CardNumber on every keypress and on blur into groups of four with one space between them for a Visa or Mastercard number (4242 4242 4242 4242; 4-6-5 for an Amex, 4-6-4 for a Diners), so the post carries the spaces. card.pan is grouped4: the rules take the number grouped in fours or as plain digits, and write the real number the way the placeholder was written.",
+            "HUMA's own payment step, read live Oct 6, 2026 (live-checks-oct6/huma_kotor_bay): the frame's cleanCardNumber rewrites CardNumber on every keypress and on blur into groups of four with one space between them for a Visa or Mastercard number (4242 4242 4242 4242; 4-6-5 for an Amex, 4-6-4 for a Diners), so the post carries the spaces.",
+            "cleanCardNumber strips every non-digit and writes the number in the format of the first CARD_TYPES row whose pattern it matches (the frame's inline script, the same in the archive.org copies and live on Oct 6): amex /^3[47]/ format_465, the first 15 digits as 4-6-5; diners_club_international /^36/ and diners_club_carte_blanche /^30[0-5]/ format_464, the first 14 digits as 4-6-4; every other row (visa, master, jcb, maestro, discover, instapayment, diners_club /^54/), and a number no row matches, format_4444, groups of four with the rest last. card.pan is grouped_by_type: the rules take the number grouped that way or as plain digits, and write the real number the way the placeholder was written, a grouped one in its own network's grouping, so a real American Express card behind a placeholder grouped in fours still goes out 4-6-5. Behind a grouped placeholder, a real 34 or 37 number of any length but 15, or a 36 or 300 to 305 number of any length but 14, is refused: the frame has no grouping for it and cuts a longer one short.",
             "The same check read when HUMA charges: its Non Refundable rate charges the whole stay at this post (the hub shows Due to pay now and its button reads PAY), while its flexible rate only guarantees the booking with the card, which the hotel charges on a late cancellation or a no-show."
         ],
         har: null,
@@ -2091,7 +2127,7 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
             required: []
         },
         card: {
-            pan: { at: "CardNumber", format: "grouped4" },
+            pan: { at: "CardNumber", format: "grouped_by_type" },
             cvv: { at: "Cvv", format: "digits" },
             exp_month: { at: "Month", format: "m" },
             exp_year: { at: "Year", format: "yyyy" },
@@ -2118,7 +2154,6 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         pending: [
             "HUMA's own payment step: whether its pay hub offers this card frame or a WSPay redirect (a HAR of one real booking's payment step)",
             "which cookies the card post needs, with DataDome in front of the host",
-            "whether D-EDGE takes a real Amex or Diners number grouped in fours, which grouped4 writes and the frame never does (it groups those 4-6-5 and 4-6-4)",
             "the answer to the card post (a redirect, a 3DS step or a page), and whether a 3DS step sends the card again",
             GUARANTEE_RATES,
             "that the bootstrap path answers without a server error"
@@ -2318,6 +2353,54 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
             "the session currency for US buyers",
             "a card-on-file policy for the monthly plans and the add-on, before any order that renews"
         ]
+    },
+    {
+        // AT&T's other card request URL, which its page posts to when the URL builder picks
+        // the exporch form: refused in observe, so a cart AT&T moves there is stopped as
+        // unsupported_checkout instead of reaching AT&T unpaused. The same form with no cart
+        // id is one of its resends, which the SDK aborts in every status.
+        id: "att_exporch_payment_info",
+        merchant: "AT&T",
+        status: "observe",
+        evidence: [
+            "att.com buy flow URL builder (module 29882, read Sep 25 to Oct 7, 2026): with meta isUnifiedMfeEnabled on, a cart whose answer names a cartType listed in meta expOrchCartType (prepaid, aia, postpaid, broadband and accessory on Oct 7), or any cart once meta useExpOrch is on, posts its card to /msapi/checkoutexporch/v1/paymentInfo, with ?cartId= and the cart id checkoutInfo named (sessionStorage CHECKOUT_MFE_CART_ID), or with no query when it named none. Meta isUnifiedOrderEnabled, off on Oct 7, would move the base under /msapi/order.",
+            "The same Networker, headers and body as the checkout path (att_payment_info), and the card-on-file step on the same base and query (/msapi/checkoutexporch/v1/cardOnFile).",
+            "Never seen live: the Oct 6 guest accessory cart named no cartType, so it posted to the checkout path."
+        ],
+        har: null,
+        checkout: "https://www.att.com",
+        checkout_frame: false,
+        frame: null,
+        endpoint: "https://www.att.com",
+        method: "POST",
+        path: "/msapi/checkoutexporch/v1/paymentInfo",
+        query: { cartId: ":cartId" },
+        navigation: null,
+        encoding: "json",
+        session: ATT_SESSION,
+        card: ATT_CARD,
+        merchant_key: null,
+        requires: ATT_REQUIRES,
+        refuse: ATT_REFUSE,
+        payment_method: null,
+        amount: { at: ["amount"], kind: "decimal_string" },
+        currency: "USD",
+        response: { headers: ["content-type", "set-cookie", "x-csrf-token"], withhold: [] },
+        resends: [
+            { method: "POST", path: "/msapi/checkoutexporch/v1/cardOnFile", query: { cartId: ":cartId" } },
+            // The card request and its card-on-file step as the page sends them when checkoutInfo
+            // named no cart id: with no query. No payment covers a form that names no checkout
+            // (once_per), so each is aborted in every status instead of reaching AT&T unpaused.
+            { method: "POST", path: "/msapi/checkoutexporch/v1/paymentInfo", query: {} },
+            { method: "POST", path: "/msapi/checkoutexporch/v1/cardOnFile", query: {} }
+        ],
+        challenge: null,
+        facts: null,
+        bootstrap: "/robots.txt",
+        timeout_ms: 3e4,
+        charge_timing: "deferred",
+        once_per: { query: "cartId" },
+        pending: ["the exporch form, never seen live: a HAR of a cart AT&T sends to /msapi/checkoutexporch/v1"]
     }
 ]);
 function wireProjection(profiles) {
@@ -3442,8 +3525,20 @@ function codeNotAsked(reader, spec, variants) {
 function groupedFour(digits) {
     return digits.replace(/(.{4})/g, "$1 ").trim();
 }
+function groupedByType(digits) {
+    const amex = /^3[47]/.test(digits);
+    if (!amex && !/^(?:36|30[0-5])/.test(digits))
+        return groupedFour(digits);
+    return digits.length === (amex ? 15 : 14) ? `${digits.slice(0, 4)} ${digits.slice(4, 10)} ${digits.slice(10)}` : null;
+}
+function groupedPan(spec, digits) {
+    if (spec.format === "grouped4")
+        return groupedFour(digits);
+    return spec.format === "grouped_by_type" ? groupedByType(digits) : null;
+}
+var CLEAR_PAN_FORMATS = /* @__PURE__ */ Object.freeze(["digits", "grouped4", "grouped_by_type"]);
 function panDigits(spec, value) {
-    return spec.format === "grouped4" && typeof value === "string" ? value.replace(/ /g, "") : value;
+    return (spec.format === "grouped4" || spec.format === "grouped_by_type") && typeof value === "string" ? value.replace(/ /g, "") : value;
 }
 function placeholderFits(p, slot, spec, value) {
     if (spec.format === "encrypted")
@@ -3457,7 +3552,7 @@ function placeholderFits(p, slot, spec, value) {
             if (!text)
                 return false;
             const digits = panDigits(spec, value);
-            return /^\d{12,19}$/.test(digits) && (digits === value || value === groupedFour(digits));
+            return /^\d{12,19}$/.test(digits) && (digits === value || value === groupedPan(spec, digits));
         }
         case "cvv":
             return text && /^\d{3,4}$/.test(value);
@@ -3488,6 +3583,8 @@ function placeholderFits(p, slot, spec, value) {
     }
 }
 var DECIMAL_AMOUNT = /^\d{1,9}(?:\.\d{1,2})?$/;
+var SCALE5_AMOUNT = /^\d{1,9}\.\d{2}000$/;
+var AMOUNT_KIND_NAMES = /* @__PURE__ */ Object.freeze({ decimal_string_scale5: "five-decimal string of whole cents" });
 function isNothing(value) {
     return value === null || value === "" || Array.isArray(value) && value.length === 0 || isPlainObject(value) && Object.keys(value).length === 0;
 }
@@ -3540,7 +3637,7 @@ function rulesRefusal(p, reader, body) {
             return `${request}: ${label} does not name a key Agentcard pinned for ${p.merchant}`;
         }
     }
-    const typed = p.card.pan && ["digits", "grouped4"].includes(p.card.pan.format) ? panDigits(p.card.pan, reader.exact(p.card.pan.at).value) : null;
+    const typed = p.card.pan && CLEAR_PAN_FORMATS.includes(p.card.pan.format) ? panDigits(p.card.pan, reader.exact(p.card.pan.at).value) : null;
     if (typed !== null) {
         if (countRuns(body, typed) !== 1) {
             return `${request}: the card number appears outside ${reader.label(p.card.pan.at)}`;
@@ -3569,9 +3666,10 @@ function rulesRefusal(p, reader, body) {
     if (p.amount) {
         const label = reader.label(p.amount.at);
         const at = reader.exact(p.amount.at);
-        const fits = p.amount.kind === "decimal_string" ? typeof at.value === "string" && DECIMAL_AMOUNT.test(at.value) : p.amount.kind === "decimal_number" ? jsonBody(p) && typeof at.value === "number" && DECIMAL_AMOUNT.test(String(at.value)) : jsonBody(p) ? Number.isSafeInteger(at.value) && at.value >= 0 : typeof at.value === "string" && /^\d{1,12}$/.test(at.value);
-        if (!at.found || reader.variants(p.amount.at).length !== 1 || !fits)
-            return `${request}: the amount at ${label} is not a ${p.amount.kind.replace("_", " ")}`;
+        const fits = p.amount.kind === "decimal_string" ? typeof at.value === "string" && DECIMAL_AMOUNT.test(at.value) : p.amount.kind === "decimal_string_scale5" ? typeof at.value === "string" && SCALE5_AMOUNT.test(at.value) : p.amount.kind === "decimal_number" ? jsonBody(p) && typeof at.value === "number" && DECIMAL_AMOUNT.test(String(at.value)) : jsonBody(p) ? Number.isSafeInteger(at.value) && at.value >= 0 : typeof at.value === "string" && /^\d{1,12}$/.test(at.value);
+        if (!at.found || reader.variants(p.amount.at).length !== 1 || !fits) {
+            return `${request}: the amount at ${label} is not a ${AMOUNT_KIND_NAMES[p.amount.kind] ?? p.amount.kind.replace("_", " ")}`;
+        }
     }
     if (isPlainObject(p.currency)) {
         const at = reader.exact(p.currency.at);
@@ -3624,7 +3722,8 @@ function merchantCardEndpointAmount(profile, body, contentType) {
     if (!TWO_DECIMAL_CURRENCIES.has(currency))
         throw new Error(`Refusing to pay: ${p.merchant}'s amount is in a currency this build does not read.`);
     const [whole, fraction = ""] = String(value).split(".");
-    return { amountCents: Number(whole) * 100 + Number(fraction.padEnd(2, "0")), currency };
+    const cents = p.amount.kind === "decimal_string_scale5" ? fraction.slice(0, 2) : fraction.padEnd(2, "0");
+    return { amountCents: Number(whole) * 100 + Number(cents), currency };
 }
 var WRITTEN_DIGIT = String.raw `(?:[0-9]|\\u003[0-9]|%3[0-9]|&#0*(?:4[89]|5[0-7]);|&#x0*3[0-9];)`;
 var WRITTEN_RUN = /* @__PURE__ */ new RegExp(`${WRITTEN_DIGIT}+(?:${SEPARATOR}+${WRITTEN_DIGIT}+)*`, "gi");
@@ -3764,7 +3863,7 @@ function assertMerchantCardEndpoint(authorization) {
     catch {
         throw new Error("Refusing to pay: malformed payment endpoint.");
     }
-    const method = authorization.method === void 0 ? "POST" : authorization.method;
+    const method = authorization.method === void 0 ? profile.method : authorization.method;
     if (!endpointMatches(profile, authorization.url, method)) {
         throw new Error(`Refusing to pay: ${url.hostname} is not ${profile.merchant}'s reviewed card endpoint.`);
     }
@@ -3914,7 +4013,7 @@ function merchantCardEndpointCheckoutKey(profile, bundle) {
 }
 function slotValue(slot, spec, placeholder, facts) {
     if (slot === "pan")
-        return spec.format === "grouped4" && placeholder.includes(" ") ? groupedFour(facts.number) : facts.number;
+        return placeholder.includes(" ") ? groupedPan(spec, facts.number) : facts.number;
     if (slot === "cvv")
         return facts.cvc;
     if (slot === "last4")
@@ -3970,7 +4069,7 @@ function substitutionPlan(p, body, contentType, card) {
     if (refusal)
         throw new SubstitutionError(refusal);
     const facts = cardFacts(card);
-    const typed = p.card.pan && ["digits", "grouped4"].includes(p.card.pan.format) ? panDigits(p.card.pan, read.reader.exact(p.card.pan.at).value) : null;
+    const typed = p.card.pan && CLEAR_PAN_FORMATS.includes(p.card.pan.format) ? panDigits(p.card.pan, read.reader.exact(p.card.pan.at).value) : null;
     if (typed === facts.number)
         throw new SubstitutionError("the paused body already carries the real card number");
     const bins = p.card.bins && facts.brand && Object.prototype.hasOwnProperty.call(p.card.bins, facts.brand) ? p.card.bins[facts.brand] : null;
@@ -3993,7 +4092,10 @@ function substitutionPlan(p, body, contentType, card) {
             writes.push({ at: spec.at, found: at, value: null, plaintext: plaintextFor(slot, spec, facts) });
         }
         else {
-            writes.push({ at: spec.at, found: at, value: slotValue(slot, spec, at.value, facts) });
+            const value = slotValue(slot, spec, at.value, facts);
+            if (value === null)
+                throw new SubstitutionError(`${p.merchant} does not take this card's number length`);
+            writes.push({ at: spec.at, found: at, value });
         }
     }
     return { read, facts, typed, writes };