@agent-cards/sdk 0.23.27 → 0.24.0

package/dist/merchant-card-endpoints.generated.js

@@ -1,11 +1,46 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: fedc712140db2d5651bed3391ac158d67dc04d8be58db9926ed328e9be20eb1b
+// artifact-sha256: 4acbca9604c5eee50f5f73dc3dea5ab0d40c9cba1214ccda0d2074271b3554a5
 // src/json-path.js
 var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function isPlainObject(v) {
     return !!v && typeof v === "object" && !Array.isArray(v);
 }
+function isTextStep(step) {
+    return isPlainObject(step) && Object.keys(step).length === 1 && step.text === "json";
+}
+function spellJson(parsed, form) {
+    const text = JSON.stringify(parsed);
+    if (form !== "php")
+        return text;
+    return text.replace(/\//g, "\\/").replace(/[\u0080-\uffff]/g, (unit) => `\\u${unit.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function jsonTextForm(value) {
+    if (typeof value !== "string" || !/^[[{]/.test(value))
+        return void 0;
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        return void 0;
+    }
+    if (parsed === null || typeof parsed !== "object")
+        return void 0;
+    for (const form of ["js", "php"]) {
+        try {
+            if (spellJson(parsed, form) === value)
+                return { parsed, form };
+        }
+        catch {
+            return void 0;
+        }
+    }
+    return void 0;
+}
+function jsonText(value) {
+    return jsonTextForm(value)?.parsed;
+}
 function jsonAt(root, path) {
     let node = root;
     for (const step of path) {
@@ -36,7 +71,12 @@ function valuesIgnoringCase(root, path) {
     for (const step of path) {
         const next = [];
         for (const node of nodes) {
-            if (typeof step === "number") {
+            if (isTextStep(step)) {
+                const inner = jsonText(node);
+                if (inner !== void 0)
+                    next.push(inner);
+            }
+            else if (typeof step === "number") {
                 if (Array.isArray(node) && Number.isSafeInteger(step) && step >= 0 && step < node.length)
                     next.push(node[step]);
             }
@@ -51,7 +91,7 @@ function valuesIgnoringCase(root, path) {
     return nodes;
 }
 function describePath(path) {
-    return path.length ? path.map((step) => typeof step === "number" ? `[${step}]` : `.${step}`).join("").replace(/^\./, "") : "(root)";
+    return path.length ? path.map((step) => typeof step === "number" ? `[${step}]` : isTextStep(step) ? "<json>" : `.${step}`).join("").replace(/^\./, "") : "(root)";
 }
 // src/url-template.js
 var PLACEHOLDER_VALUE = /^[A-Za-z0-9._~@+-]{1,256}$/;
@@ -157,6 +197,192 @@ var SubstitutionError = class extends Error {
         this.name = "SubstitutionError";
     }
 };
+// src/three-ds-step.js
+var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+var PERCENT_LAYERS = 8;
+function percentDecoded(text) {
+    let out = text;
+    for (let layer = 0; layer < PERCENT_LAYERS; layer += 1) {
+        const next = out.replace(/%([0-9A-Fa-f]{2})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
+        if (next === out)
+            break;
+        out = next;
+    }
+    return out;
+}
+var NAMED = /* @__PURE__ */ Object.freeze({
+    amp: "&",
+    percnt: "%",
+    num: "#",
+    quest: "?",
+    semi: ";",
+    excl: "!",
+    dollar: "$",
+    lpar: "(",
+    rpar: ")",
+    ast: "*",
+    comma: ",",
+    commat: "@",
+    lsqb: "[",
+    rsqb: "]",
+    lcub: "{",
+    rcub: "}",
+    verbar: "|",
+    bsol: "\\",
+    hat: "^",
+    grave: "`",
+    plus: "+",
+    sol: "/",
+    equals: "=",
+    lowbar: "_",
+    period: ".",
+    colon: ":",
+    quot: '"',
+    apos: "'",
+    lt: "<",
+    gt: ">"
+});
+var NUMERIC = "#(?:[xX]([0-9a-fA-F]+)|([0-9]+));?";
+var BARE_NAME = "(sup[123]|frac(?:12|14|34)|[A-Za-z]+);?";
+var referenceText = (hex, decimal, name) => {
+    if (name !== void 0)
+        return Object.prototype.hasOwnProperty.call(NAMED, name.toLowerCase()) ? NAMED[name.toLowerCase()] : " ";
+    const point = hex === void 0 ? parseInt(decimal, 10) : parseInt(hex, 16);
+    return point <= 1114111 ? String.fromCodePoint(point) : "";
+};
+function referenceReadings(text) {
+    const read = (pattern) => text.replace(new RegExp(`&(?:${NUMERIC}|${pattern})`, "g"), (_, hex, decimal, name) => referenceText(hex, decimal, name));
+    return [read("([A-Za-z][A-Za-z0-9]*);"), read(BARE_NAME)];
+}
+function readings(text) {
+    const out = /* @__PURE__ */ new Set([text, percentDecoded(text)]);
+    for (const reading of [...out])
+        for (const decoded of referenceReadings(reading))
+            out.add(decoded).add(percentDecoded(decoded));
+    return out;
+}
+function base64Bytes(run, skip) {
+    let bits = 0;
+    let value = 0;
+    let out = "";
+    for (let i = skip; i < run.length; i += 1) {
+        const char = run[i];
+        value = value << 6 | (char === "-" ? 62 : char === "_" ? 63 : ALPHABET.indexOf(char));
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            out += String.fromCharCode(value >> bits);
+            value &= (1 << bits) - 1;
+        }
+    }
+    return out;
+}
+var base64Text = (value) => base64Bytes(value.replace(/=+$/, ""), 0);
+// src/test-pans.js
+function immutableSet(values, name) {
+    const set = new Set(values);
+    for (const method of ["add", "delete", "clear"]) {
+        set[method] = () => {
+            throw new TypeError(`${name} is immutable`);
+        };
+    }
+    return Object.freeze(set);
+}
+var DOCUMENTED_TEST_PANS = /* @__PURE__ */ immutableSet([
+    "4242424242424242",
+    "4000000000000002",
+    "4000002500003155",
+    "4111111111111111"
+], "DOCUMENTED_TEST_PANS");
+// src/answer-card-leak.js
+var ANSWER_HOLDS_CARD = "card_in_answer";
+var LAYERS = 2;
+var BASE64_RUN = /[A-Za-z0-9+/_-]{6,}/g;
+var BASE64_PIECE = /[A-Za-z0-9+/_-]{2,}={0,2}/g;
+var VALUE_END = /["'<>&=,;:{}[\]|\r\n\t]/;
+var DECIMAL = /\p{Nd}/u;
+var PIECE = 4;
+function digitValue(char) {
+    const point = char.codePointAt(0);
+    let first = point;
+    while (DECIMAL.test(String.fromCodePoint(first - 1)))
+        first -= 1;
+    return String((point - first) % 10);
+}
+var ENCLOSED = /* @__PURE__ */ Object.freeze([[9451, 10, 11], [9461, 10, 1], [9471, 1, 0], [10102, 30, 1], [127243, 2, 0]]);
+var ENCLOSED_CHAR = /[\u24eb-\u24ff\u2776-\u2793\u{1f10b}\u{1f10c}]/gu;
+function enclosedValue(char) {
+    const point = char.codePointAt(0);
+    const [first, , start] = ENCLOSED.find(([from, size]) => point >= from && point < from + size);
+    return String(first === 127243 ? 0 : first === 10102 ? (point - first) % 10 + 1 : start + point - first);
+}
+var asciiDigits = (text) => (typeof text.normalize === "function" ? text.normalize("NFKC") : text).replace(ENCLOSED_CHAR, enclosedValue).replace(/\p{Nd}/gu, (char) => char >= "0" && char <= "9" ? char : digitValue(char));
+var unescaped = (text) => text.replace(/\\u([0-9a-fA-F]{4})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
+var decodedInPlace = (text) => text.replace(BASE64_PIECE, (piece) => {
+    const bare = piece.replace(/=+$/, "");
+    for (let skip = 0; skip < 4 && skip < bare.length - 1; skip += 1) {
+        const bytes = base64Text(bare.slice(skip));
+        if (/^[\x20-\x7e]+$/.test(bytes))
+            return bare.slice(0, skip) + bytes;
+    }
+    return piece;
+});
+function collect(text, layers, streams, runs) {
+    const base = /* @__PURE__ */ new Set([...readings(text), ...readings(unescaped(text))]);
+    for (const reading of /* @__PURE__ */ new Set([...base, ...[...base].map(decodedInPlace)])) {
+        const digits = asciiDigits(reading);
+        const sequence = digits.match(/[0-9]+/g) ?? [];
+        streams.add(sequence);
+        for (const run of sequence)
+            runs.add(run);
+        for (const value of digits.split(VALUE_END))
+            if (/[0-9]/.test(value))
+                runs.add(value.replace(/[^0-9]/g, ""));
+        if (layers === 0)
+            continue;
+        for (const run of new Set(reading.match(BASE64_RUN))) {
+            for (let skip = 0; skip < 4; skip += 1)
+                collect(base64Text(run.slice(skip)), layers - 1, streams, runs);
+        }
+    }
+}
+function joined(target, runs, shown) {
+    const list = [...runs];
+    const hidden = (part, run) => !shown.has(part) && !shown.has(run);
+    const rest = (p, used, hides) => list.some((run) => !used.includes(run) && (run.startsWith(target.slice(p)) && (hides || hidden(target.slice(p), run)) || run.length >= PIECE && p + run.length <= target.length - PIECE && target.startsWith(run, p) && rest(p + run.length, [...used, run], hides || hidden(run, run))));
+    return list.some((first) => {
+        for (let p = PIECE; p <= target.length - PIECE && p <= first.length; p += 1) {
+            if (first.endsWith(target.slice(0, p)) && rest(p, [first], hidden(target.slice(0, p), first)))
+                return true;
+        }
+        return false;
+    });
+}
+function inOrder(targets, stream, shown) {
+    const digits = stream.join("");
+    if (digits.length < targets[targets.length - 1].length)
+        return false;
+    const hidden = stream.map((run) => (shown.has(run) ? "0" : "1").repeat(run.length)).join("");
+    return targets.some((target) => {
+        for (let at = digits.indexOf(target); at >= 0; at = digits.indexOf(target, at + 1)) {
+            if (hidden.slice(at, at + target.length).includes("1"))
+                return true;
+        }
+        return false;
+    });
+}
+function answerCardLeak(card, texts) {
+    const number = card && (typeof card.number === "string" || typeof card.number === "number") ? String(card.number).replace(/[^0-9]/g, "") : "";
+    if (number.length < 12 || number.length > 19 || DOCUMENTED_TEST_PANS.has(number))
+        return null;
+    const streams = /* @__PURE__ */ new Set();
+    const runs = /* @__PURE__ */ new Set();
+    for (const text of Array.isArray(texts) ? texts : [texts])
+        collect(typeof text === "string" ? text : JSON.stringify(text) ?? "", LAYERS, streams, runs);
+    const shown = new Set([6, 8].flatMap((bin) => [number.slice(0, bin), number.slice(0, bin) + number.slice(-4)]).concat(number.slice(-4)));
+    const targets = [number, number.slice(0, -1)];
+    return [...streams].some((stream) => inOrder(targets, stream, shown)) || targets.some((target) => joined(target, runs, shown)) ? ANSWER_HOLDS_CARD : null;
+}
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -2421,9 +2647,11 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
             "www.nike.com guest checkout, read live on Oct 23, 2026 in a Kernel browser with every non-GET request aborted before it left (a placeholder card, nothing sent): the card is typed into Nike's own card frame, https://paymentcc.nike.com/services/default?id=<creditCardInfoId>&ctx=…&language=…&maskerEnabled=…, a form #creditCardForm with #creditCardNumber, #expirationDate (MM/YY) and #cvNumber and hidden expirationMonth and expirationYear. No processor frame, tokenizer or client-side encryption is on the page.",
             "The frame's own script (/resources/js/common.js) posts the card once all three fields are valid, on a field's blur or keyup, with no button press: XHR POST /creditcardsubmit/<creditCardInfoId>/store, Content-Type application/json; charset=utf-8, body {accountNumber (digits), cardType, expirationMonth (MM), expirationYear ('20' + YY), creditCardInfoId (the frame's id query value, the same as the path), cvNumber}. The captured request carried the .nike.com cookies (Akamai's ak_bmsc and bm_sv among them), Origin https://paymentcc.nike.com, and no CSRF or auth header.",
             "cardType comes from the frame's own validator table, first match wins: AMERICANEXPRESS (34, 37), CARTASI (a list of Italian 4 and 5 BINs), CARTEBLEUE, DANKORT, DISCOVER, DINERS, DOMESTICMAESTRO, INTERNATIONALMAESTRO, JCB, MASTERCARD (51-55 and 2221-2720), VISAELECTRON, VISA (4).",
-            "After the post the frame asks GET /creditcardsubmit/<id>/isValid?mode=1 and tells the page its brand, last four and expiry by postMessage. A CVV-only change sends PUT /creditcardsubmit/<id>/update {cvNumber}. Continue to Order Review then posts https://api.nike.com/payment/preview/v3 with paymentInfo naming the creditCardInfoId, the brand, the last four and a masked accountNumber, beside the checkout total and currency: no card number leaves the page outside the store request."
+            "After the post the frame asks GET /creditcardsubmit/<id>/isValid?mode=1 and tells the page its brand, last four and expiry by postMessage. A CVV-only change sends PUT /creditcardsubmit/<id>/update {cvNumber}. Continue to Order Review then posts https://api.nike.com/payment/preview/v3 with paymentInfo naming the creditCardInfoId, the brand, the last four and a masked accountNumber, beside the checkout total and currency: no card number leaves the page outside the store request.",
+            "Felipe Abello's recorded www.nike.com guest purchase with a one-time Agentcard Mastercard, Oct 23, 2026 (he reviewed the HAR and sent its facts as text; no card value, cookie or HAR entry is in this table): the store post answered 201 Created with an empty body (Content-Length 0), its path and body naming one creditCardInfoId UUID; isValid?mode=1 answered 200 with the JSON booleans cc, cvv, exp and isValid; payment/preview/v3 named the card MASTERCARD in paymentInfo[0].",
+            "The same purchase: a checkout preview job (GET /buy/checkout_previews_jobs/v3/…, the rest of that line not recorded) prices the order, and the page sends the total twice, both after the store post: in payment/preview/v3 (a top-level total and currency, and paymentInfo[] naming the creditCardInfoId), a pre-check that answered validForCheckout true and is3DSRequired false and charges nothing, and in PUT https://api.nike.com/buy/checkouts/v3/<checkoutId> (request.totals.total, a paymentToken, no card data), which answers 202 with a PENDING job. GET /buy/checkouts_jobs/v3/<checkoutId> then read COMPLETED with an orderId, a paymentApprovalId and paymentStatus ACCEPT: that PUT authorizes the card."
         ],
-        har: null,
+        har: "Felipe Abello, Oct 23, 2026: one www.nike.com guest purchase he ran and recorded with a one-time Agentcard Mastercard and reviewed himself, its facts sent as text. It confirms the store post, its answer, isValid, the Mastercard code and the order calls after it. It ran in his own browser, so it shows nothing of how Akamai treats the relay's request.",
         checkout: "https://www.nike.com",
         checkout_frame: false,
         frame: "https://paymentcc.nike.com",
@@ -2447,7 +2675,10 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
             expiry: null,
             last4: null,
             leading: null,
-            brands: [{ at: ["cardType"], map: { visa: "VISA", mastercard: "MASTERCARD", amex: "AMERICANEXPRESS", discover: "DISCOVER" } }],
+            // The recorded purchase shows MASTERCARD only. The frame's table writes other codes for other networks, but no
+            // purchase shows Nike taking one, so the device refuses a card of another network and the body rules refuse a
+            // placeholder the frame names otherwise: the agent types a Mastercard-range placeholder.
+            brands: [{ at: ["cardType"], map: { mastercard: "MASTERCARD" } }],
             bins: null
         },
         merchant_key: null,
@@ -2457,9 +2688,12 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         ],
         refuse: [],
         payment_method: null,
-        // The store request carries no total: the order's total first travels in payment/preview/v3, after it.
+        // The store post carries no total: Nike's total travels after it, in payment/preview/v3 and the order's PUT, which the
+        // checkout SDK holds to the approved amount (merchant-card-endpoint-nike-order.js).
         amount: null,
         currency: "USD",
+        // Nike answers the store post 201 Created with an empty body: the card is stored under the creditCardInfoId and nothing
+        // is charged until the order's PUT. The approve records the row approved on that answer, which means sent, never paid.
         response: { headers: ["content-type"], withhold: [] },
         resends: [
             // The frame's CVV-only update, which sends the typed security code again outside the store request.
@@ -2472,12 +2706,10 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         timeout_ms: 3e4,
         charge_timing: "deferred",
         once_per: { path: "creditCardInfoId" },
+        // What keeps Nike in observe. What only a purchase through the relay can show (Akamai's view of the relay's request,
+        // a capture when the order ships) and the codes of other networks are open in PROOF.md, beside the attended purchase.
         pending: [
-            "the answer to the store request (status, body and headers) and to isValid, which this capture aborted before they were sent",
-            "a total to hold the agent's amount to: the store request names none, and Nike's checkout total travels only in payment/preview/v3 after it",
-            "which call authorizes the card (payment/preview/v3 or the order submit), and whether the charge when the order ships needs the card to stay open",
-            "a card the frame names CARTASI, CARTEBLEUE, DANKORT or a Maestro type, which the brand map writes as its network's code",
-            "whether Akamai accepts the relay's request with cookies the agent's browser minted"
+            `a total to hold the agent's amount to, in the form Nike's order writes it: the checkout SDK holds the order's PUT to the approved amount (merchant-card-endpoint-nike-order.js), reading request.totals.total as a JSON number and request.currency, and refuses any other form. The recorded purchase's facts name that path and an amount ending "4.76 USD", and the paste cut the JSON type and where the order names its currency, which a person confirms from the recorded purchase`
         ]
     }
 ]);
@@ -3285,6 +3517,96 @@ function merchantCardEndpointFactsRefusal(profile, facts, agent) {
     }
     return null;
 }
+// src/merchant-card-endpoint-nike-order.js
+var NIKE_ORDER = /* @__PURE__ */ deepFreeze({
+    profile: "nike_paymentcc_store",
+    host: "api.nike.com",
+    origin: "https://api.nike.com",
+    method: "PUT",
+    path: "/buy/checkouts/v3/:checkoutId",
+    total: ["request", "totals", "total"],
+    currency: ["request", "currency"]
+});
+var NIKE_ORDER_REFUSALS = /* @__PURE__ */ deepFreeze([
+    "request_unrecognized",
+    "body_unreadable",
+    "total_unreadable",
+    "currency_unreadable",
+    "currency_mismatch",
+    "amount_mismatch",
+    "approval_unknown"
+]);
+var BODY_MAX = 256 * 1024;
+var TOTAL_TEXT = /^\d{1,9}(?:\.\d{1,2})?$/;
+var READS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function nikeOrderHost(url) {
+    try {
+        return new URL(url).hostname.replace(/\.$/, "") === NIKE_ORDER.host;
+    }
+    catch {
+        return false;
+    }
+}
+function serverSegments(pathname) {
+    let path = pathname;
+    for (let round = 0; round < 4; round += 1) {
+        let decoded;
+        try {
+            decoded = decodeURIComponent(path);
+        }
+        catch {
+            return null;
+        }
+        if (decoded === path)
+            break;
+        path = decoded;
+    }
+    const segments = [];
+    for (const raw of path.replace(/\\/g, "/").split("/")) {
+        const segment = raw.split(";")[0].toLowerCase();
+        if (segment === "..")
+            segments.pop();
+        else if (segment !== "" && segment !== ".")
+            segments.push(segment);
+    }
+    return segments;
+}
+function nikeOrderRequest(url, method) {
+    if (typeof method !== "string" || READS.has(method.toUpperCase()) || !nikeOrderHost(url))
+        return false;
+    const segments = serverSegments(new URL(url).pathname);
+    return segments === null || segments[0] === "buy" && segments[1] === "checkouts";
+}
+function nikeOrderRefusal(url, method, body, approved) {
+    const want = isPlainObject(approved) ? approved.amount : void 0;
+    const currency = isPlainObject(approved) && typeof approved.currency === "string" ? approved.currency.toLowerCase() : "";
+    if (!Number.isSafeInteger(want) || want <= 0 || !TWO_DECIMAL_CURRENCIES.has(currency))
+        return "approval_unknown";
+    const match = typeof method === "string" && method.toUpperCase() === NIKE_ORDER.method ? urlTemplateMatch({ path: NIKE_ORDER.path, query: {} }, url) : null;
+    if (match?.origin !== NIKE_ORDER.origin)
+        return "request_unrecognized";
+    if (typeof body !== "string" || body.length > BODY_MAX)
+        return "body_unreadable";
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return "body_unreadable";
+    }
+    if (!isPlainObject(parsed) || !roundTrips(parsed, body))
+        return "body_unreadable";
+    const total = jsonAt(parsed, NIKE_ORDER.total);
+    if (!total.found || typeof total.value !== "number" || !TOTAL_TEXT.test(String(total.value)))
+        return "total_unreadable";
+    const named = jsonAt(parsed, NIKE_ORDER.currency);
+    if (!named.found || typeof named.value !== "string" || !/^[A-Z]{3}$/.test(named.value))
+        return "currency_unreadable";
+    if (named.value !== currency.toUpperCase())
+        return "currency_mismatch";
+    const [whole, fraction = ""] = String(total.value).split(".");
+    return Number(whole) * 100 + Number(fraction.padEnd(2, "0")) === want ? null : "amount_mismatch";
+}
 // src/merchant-card-endpoints.js
 var MERCHANT_CARD_ENDPOINT_LIMITS = /* @__PURE__ */ Object.freeze({
     bodyBytes: 128 * 1024,
@@ -3377,7 +3699,7 @@ function codeNearKey(text, code) {
             return true;
         for (const [run] of near.replace(BASE64_ESCAPE, unescapeBase64).matchAll(CODE_BASE64_RUN)) {
             for (let skip = 0; skip < 4; skip += 1)
-                if (code.test(base64Bytes(run, skip).replace(/\0/g, "")))
+                if (code.test(base64Bytes2(run, skip).replace(/\0/g, "")))
                     return true;
         }
     }
@@ -4415,13 +4737,13 @@ function answerParts(response) {
     }
     return pairs;
 }
-var BASE64_RUN = /[A-Za-z0-9+/_-]{8,}/g;
+var BASE64_RUN2 = /[A-Za-z0-9+/_-]{8,}/g;
 var STREAM_RUN_LENGTH = 16;
 var CODE_BASE64_RUN = /[A-Za-z0-9+/_-]{4,}/g;
 var BASE64_ESCAPE = /\\\/|\\u002[bBfF]|%2[bBfF]|&#(?:43|47|x2[bBfF]);/g;
 var BASE64_ALPHABET2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 var unescapeBase64 = (escape) => /43|[bB]/.test(escape) ? "+" : "/";
-function base64Bytes(run, skip) {
+function base64Bytes2(run, skip) {
     let bits = 0;
     let value = 0;
     let out = "";
@@ -4452,9 +4774,9 @@ function carriesCard(text, facts, pan, code, depth, seen) {
         return true;
     if (depth === 0)
         return false;
-    for (const [run] of text.replace(BASE64_ESCAPE, unescapeBase64).matchAll(BASE64_RUN)) {
+    for (const [run] of text.replace(BASE64_ESCAPE, unescapeBase64).matchAll(BASE64_RUN2)) {
         for (let skip = 0; skip < 4; skip += 1) {
-            const bytes = base64Bytes(run, skip);
+            const bytes = base64Bytes2(run, skip);
             if (run.length >= STREAM_RUN_LENGTH && compressedStream(bytes))
                 seen.compressed = true;
             if (carriesCard(bytes.replace(/\0/g, ""), facts, pan, code, depth - 1, seen))
@@ -4468,10 +4790,13 @@ function responseCardLeak(card, response) {
     const pan = digitRun(facts.number);
     const code = codeRun(facts.cvc);
     const seen = { compressed: false };
-    for (const text of [response.bodyText, ...answerParts(response).flat()]) {
+    const texts = [response.bodyText, ...answerParts(response).flat()];
+    for (const text of texts) {
         if (carriesCard(text, facts, pan, code, 2, seen))
             return "card_in_response";
     }
+    if (answerCardLeak(facts, texts))
+        return "card_in_response";
     return seen.compressed ? "unreadable_in_response" : null;
 }
 var JSON_PROTECTION_PREFIX = /^\)\]\}',?\n/;
@@ -4532,4 +4857,4 @@ function merchantCardEndpointNavigationAnswer(profile, answer, requestUrl) {
         return { kind: "refused", reason: "redirect_location_invalid" };
     return { kind: "redirect", status, location: target.href };
 }
-export { HILTON_CREATE_RESERVATION_DOCUMENTS, MERCHANT_CARD_ENDPOINT_CLIENT_TABLE, MERCHANT_CARD_ENDPOINT_FACTS_TEXT_MAX, MERCHANT_CARD_ENDPOINT_FACT_READERS, MERCHANT_CARD_ENDPOINT_LIMITS, MERCHANT_CARD_ENDPOINT_MODE, MERCHANT_CARD_ENDPOINT_PROFILES, MERCHANT_CARD_ENDPOINT_PSP, MERCHANT_CARD_ENDPOINT_RECOGNIZERS, SubstitutionError, assertMerchantCardEndpoint, encryptMerchantCardEndpointBody, encryptedMerchantEndpointRequest, matchMerchantCardEndpoint, matchMerchantCardEndpointResend, merchantCardEndpointAmount, merchantCardEndpointAnswer, merchantCardEndpointAnswerRefusal, merchantCardEndpointBodyRefusal, merchantCardEndpointById, merchantCardEndpointCarriesCard, merchantCardEndpointCheckoutKey, merchantCardEndpointEncrypts, merchantCardEndpointFactsRefusal, merchantCardEndpointFactsRole, merchantCardEndpointLive, merchantCardEndpointMatches, merchantCardEndpointNavigationAnswer, merchantCardEndpointPasses, merchantCardEndpointRecognizerById, merchantCardEndpointRequestOrigin, merchantCardEndpointSessionRefusal, merchantCardEndpointSessionTtl, merchantEndpointRequest, projectMerchantCardEndpointFacts, readMerchantCardEndpointFacts, responseCardLeak, substituteMerchantCardEndpoint, trustedMerchantCardEndpoint };
+export { HILTON_CREATE_RESERVATION_DOCUMENTS, MERCHANT_CARD_ENDPOINT_CLIENT_TABLE, MERCHANT_CARD_ENDPOINT_FACTS_TEXT_MAX, MERCHANT_CARD_ENDPOINT_FACT_READERS, MERCHANT_CARD_ENDPOINT_LIMITS, MERCHANT_CARD_ENDPOINT_MODE, MERCHANT_CARD_ENDPOINT_PROFILES, MERCHANT_CARD_ENDPOINT_PSP, MERCHANT_CARD_ENDPOINT_RECOGNIZERS, NIKE_ORDER, NIKE_ORDER_REFUSALS, SubstitutionError, assertMerchantCardEndpoint, encryptMerchantCardEndpointBody, encryptedMerchantEndpointRequest, matchMerchantCardEndpoint, matchMerchantCardEndpointResend, merchantCardEndpointAmount, merchantCardEndpointAnswer, merchantCardEndpointAnswerRefusal, merchantCardEndpointBodyRefusal, merchantCardEndpointById, merchantCardEndpointCarriesCard, merchantCardEndpointCheckoutKey, merchantCardEndpointEncrypts, merchantCardEndpointFactsRefusal, merchantCardEndpointFactsRole, merchantCardEndpointLive, merchantCardEndpointMatches, merchantCardEndpointNavigationAnswer, merchantCardEndpointPasses, merchantCardEndpointRecognizerById, merchantCardEndpointRequestOrigin, merchantCardEndpointSessionRefusal, merchantCardEndpointSessionTtl, merchantEndpointRequest, nikeOrderHost, nikeOrderRefusal, nikeOrderRequest, projectMerchantCardEndpointFacts, readMerchantCardEndpointFacts, responseCardLeak, substituteMerchantCardEndpoint, trustedMerchantCardEndpoint };

package/dist/merchant-hosted.d.ts

@@ -35,6 +35,12 @@ export type MerchantRequestVerdict = {
 };
 /** One step of a JSON path: an object key, or an index into an array. */
 export type JsonPathStep = string | number;
+/** The step into a string that holds JSON text (payment-core json-path.js TEXT_STEP). */
+export type JsonTextStep = {
+    text: 'json';
+};
+/** One step of a profile's holder path: a JSON path step, or the step into JSON text the body carries. */
+export type ProfilePathStep = JsonPathStep | JsonTextStep;
 /** A card fact the API asks to write beside the ciphertext (reserved: no profile declares one yet). */
 export interface MerchantHostedFact {
     path: JsonPathStep[];
@@ -51,7 +57,8 @@ export interface MerchantHostedSubstitutions {
     encoding: 'json';
     kind: 'merchant_hosted';
     profile: string;
-    path: JsonPathStep[];
+    /** The holder: it may step into JSON text the body carries (SCHEELS' `state`); a fact's path never does. */
+    path: ProfilePathStep[];
     fields: Record<string, string>;
     remove: string[];
     /** Card facts to write after the swap. No profile declares any yet, and the substitution refuses them. */

package/dist/nike-order.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Why the gate refuses Nike's order: payment-core's reasons; an earlier order under the same approval refused; another
+ * order than the one already let go under it; or an approval the checkout no longer names as under way (cancelled, a
+ * new attempt, a final state, a reconciliation running).
+ */
+export type NikeOrderRefusal = 'request_unrecognized' | 'body_unreadable' | 'total_unreadable' | 'currency_unreadable' | 'currency_mismatch' | 'amount_mismatch' | 'approval_unknown' | 'earlier_order_refused' | 'another_order' | 'approval_not_current';
+/** What an event may say about Nike's order: its profile and origin, never the order's URL or body. */
+export declare const NIKE_ORDER_DETAIL: Readonly<{
+    profile: string;
+    origin: string;
+}>;
+/** Fetch.enable's patterns for Nike's API host in every spelling a browser sends; nikeOrderRequest is the exact check. */
+export declare const NIKE_ORDER_PATTERNS: readonly string[];
+/** Whether the Playwright adapter routes a URL, which it sees without its method: any URL on Nike's API host. */
+export declare function nikeOrderRouted(url: string): boolean;
+/** The approval Nike's order is held to on one attachment, once a card went through Nike's profile. */
+export declare class NikeOrders {
+    private held;
+    /**
+     * The adapters are about to ask the cardholder to pay a card request to `profile`. From the create on, the device may
+     * store the card at Nike whatever this attachment then reads back, so for Nike's profile every order is held from
+     * here, and refused until the approved answer names its amount (remember). True for Nike's profile; another profile
+     * changes nothing.
+     */
+    asking(profile: string): boolean;
+    /**
+     * An approved card endpoint answer, read before it reaches the page: for Nike's profile, its approval is the one Nike's
+     * orders are held to, at the amount the API's read names (none, and every order is refused). It is the attempt
+     * asking() armed, so an order refused while the approval was on its way keeps the rest refused; only the next
+     * asking() clears that. Another profile's answer changes nothing.
+     */
+    remember(replay: {
+        authorizationId: string;
+        profile: string;
+        approved?: {
+            amount: number;
+            currency: string;
+        };
+    }): void;
+    /**
+     * The gate's verdict on a paused request, or null when it is left alone: no card went through Nike's profile here, or
+     * the request is not Nike's order. `current` says whether the checkout still names an approval as under way: once an
+     * approved answer is in, an order the checkout no longer names as under way is stopped before the rule reads it, so a
+     * late order never ends an attempt that came after. One order goes, and after it only a byte-identical retry; after
+     * one refusal every later order under that approval is refused.
+     */
+    judge(url: string, method: string, body: () => string | null, current: (authorizationId: string | null) => boolean): {
+        authorizationId: string | null;
+        refusal: NikeOrderRefusal | null;
+    } | null;
+}

package/dist/nike-order.js

@@ -0,0 +1,81 @@
+// Nike's order after its card request (payment-core merchant-card-endpoint-nike-order.js), Felipe's amount rule C.
+//
+// Nike's store post names no total: the cardholder's device stores the card under the checkout's id, and Nike charges
+// nothing until the page sends its order, PUT https://api.nike.com/buy/checkouts/v3/<checkoutId>. So once the adapters
+// ask the cardholder to pay a card request through Nike's profile on an attachment, they hand every write to Nike's API
+// host to the pre-claim gate (pre-claim.ts nikeOrderGate). It lets one order go unchanged, only when its total and
+// currency are the amount the cardholder approved and only while the checkout still names that approval as under way,
+// and after it only a byte-identical retry. Before that, on any other attachment, and for every other request, nothing
+// here holds anything. The order's URL and body are cardholder data: no event names them.
+import { NIKE_ORDER as SHARED_ORDER, nikeOrderHost as sharedHost, nikeOrderRefusal as sharedRefusal, nikeOrderRequest as sharedRequest, } from './merchant-card-endpoints.generated.js';
+const ORDER = SHARED_ORDER;
+/** What an event may say about Nike's order: its profile and origin, never the order's URL or body. */
+export const NIKE_ORDER_DETAIL = Object.freeze({ profile: ORDER.profile, origin: ORDER.origin });
+/** Fetch.enable's patterns for Nike's API host in every spelling a browser sends; nikeOrderRequest is the exact check. */
+export const NIKE_ORDER_PATTERNS = [`https://${ORDER.host}*`, `http://${ORDER.host}*`];
+/** Whether the Playwright adapter routes a URL, which it sees without its method: any URL on Nike's API host. */
+export function nikeOrderRouted(url) {
+    return sharedHost(url) === true;
+}
+/** The approval Nike's order is held to on one attachment, once a card went through Nike's profile. */
+export class NikeOrders {
+    held = null;
+    /**
+     * The adapters are about to ask the cardholder to pay a card request to `profile`. From the create on, the device may
+     * store the card at Nike whatever this attachment then reads back, so for Nike's profile every order is held from
+     * here, and refused until the approved answer names its amount (remember). True for Nike's profile; another profile
+     * changes nothing.
+     */
+    asking(profile) {
+        if (profile !== ORDER.profile)
+            return false;
+        this.held = { authorizationId: null, approved: null, refused: false, released: null };
+        return true;
+    }
+    /**
+     * An approved card endpoint answer, read before it reaches the page: for Nike's profile, its approval is the one Nike's
+     * orders are held to, at the amount the API's read names (none, and every order is refused). It is the attempt
+     * asking() armed, so an order refused while the approval was on its way keeps the rest refused; only the next
+     * asking() clears that. Another profile's answer changes nothing.
+     */
+    remember(replay) {
+        if (replay.profile !== ORDER.profile)
+            return;
+        this.held = { authorizationId: replay.authorizationId, approved: replay.approved ?? null, refused: this.held?.refused ?? false, released: null };
+    }
+    /**
+     * The gate's verdict on a paused request, or null when it is left alone: no card went through Nike's profile here, or
+     * the request is not Nike's order. `current` says whether the checkout still names an approval as under way: once an
+     * approved answer is in, an order the checkout no longer names as under way is stopped before the rule reads it, so a
+     * late order never ends an attempt that came after. One order goes, and after it only a byte-identical retry; after
+     * one refusal every later order under that approval is refused.
+     */
+    judge(url, method, body, current) {
+        const held = this.held;
+        if (!held || sharedRequest(url, method) !== true)
+            return null;
+        const verdict = (refusal) => ({ authorizationId: held.authorizationId, refusal });
+        if (held.refused)
+            return verdict('earlier_order_refused');
+        // While the approval is still on its way, the rule refuses every order (approval_unknown), and that stands.
+        if (held.authorizationId !== null && !current(held.authorizationId))
+            return verdict('approval_not_current');
+        let text;
+        try {
+            text = body();
+        }
+        catch {
+            text = null;
+        }
+        const sent = held.released;
+        if (sent)
+            return verdict(sent.method === method.toUpperCase() && sent.url === url && sent.body === text ? null : 'another_order');
+        const refusal = sharedRefusal(url, method, text, held.approved);
+        if (refusal !== null) {
+            held.refused = true;
+            return verdict(refusal);
+        }
+        held.released = { method: method.toUpperCase(), url, body: text };
+        return verdict(null);
+    }
+}