@agent-cards/sdk 0.23.27 → 0.24.0

package/dist/oceanpayment.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Oceanpayment's hosted payment page (secure.oceanpayment.com, and test-secure.oceanpayment.com, its sandbox), as this SDK
+ * reads it.
+ *
+ * The page, where Oceanpayment's Shopify redirect app sends the buyer after Shopify's Pay now, submits its card form as one
+ * form post to /gateway/sendPay;jsessionid=<the payment's session>, the card in clear. That post is the one request this
+ * SDK pauses: the cardholder's device writes the real card into it and sends it through the checkout relay (payment-core
+ * processors/oceanpayment.js). The page's other posts to these hosts lead to or carry the card the agent typed: Cardinal's
+ * device-data call (/gateway/CreateJWTInterface) posts the whole number when the merchant's terminal turns it on, and a card
+ * post written another way would carry it to Oceanpayment as a payment. This SDK aborts every one of them in a page it
+ * watches, so the agent's placeholder never reaches Oceanpayment. A GET (the page, its scripts, its log) continues.
+ *
+ * OCEANPAYMENT_HOSTS is payment-core's OCEANPAYMENT_HOSTS, and isOceanpaymentSendPay takes the URLs payment-core's
+ * isOceanpaymentSendPayUrl takes; oceanpayment.test.mjs pins both to payment-core.
+ */
+export declare const OCEANPAYMENT_PSP = "oceanpayment";
+/** The dark-launch capability the API serves Oceanpayment's recognizer behind (payment-core processors/oceanpayment.js). */
+export declare const OCEANPAYMENT_CAPABILITY = "oceanpayment_hosted_payment_page";
+/** The live host and Oceanpayment's sandbox, which serves the same page for a test terminal. */
+export declare const OCEANPAYMENT_HOSTS: readonly string[];
+/** Whether this URL is on one of Oceanpayment's two hosts. */
+export declare function isOceanpaymentHost(url: string): boolean;
+/**
+ * The only request on Oceanpayment's hosts that is the page's card post: a POST to exactly
+ * https://<host>/gateway/sendPay;jsessionid=<session>, as the page's form action writes it, with no port, query, fragment
+ * or other spelling (payment-core isOceanpaymentSendPayUrl takes the same strings). The post the SDK pauses.
+ */
+export declare function isOceanpaymentSendPay(url: string, method: string): boolean;
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on an Oceanpayment host and this build's
+ * registry serves Oceanpayment's card post there. Cardinal's call and a card post of another spelling are not the card
+ * post, so the registry's card-request test does not name them; the CDP adapter still pauses them through the
+ * recognizer's host pattern, and attachToPlaywright's route predicate asks this, so both adapters show the gates every
+ * request to Oceanpayment once Oceanpayment is armed.
+ */
+export declare function isArmedOceanpaymentUrl(vault: {
+    isCardRequest(url: string, method?: string): boolean;
+}, url: string): boolean;

package/dist/oceanpayment.js

@@ -0,0 +1,70 @@
+/**
+ * Oceanpayment's hosted payment page (secure.oceanpayment.com, and test-secure.oceanpayment.com, its sandbox), as this SDK
+ * reads it.
+ *
+ * The page, where Oceanpayment's Shopify redirect app sends the buyer after Shopify's Pay now, submits its card form as one
+ * form post to /gateway/sendPay;jsessionid=<the payment's session>, the card in clear. That post is the one request this
+ * SDK pauses: the cardholder's device writes the real card into it and sends it through the checkout relay (payment-core
+ * processors/oceanpayment.js). The page's other posts to these hosts lead to or carry the card the agent typed: Cardinal's
+ * device-data call (/gateway/CreateJWTInterface) posts the whole number when the merchant's terminal turns it on, and a card
+ * post written another way would carry it to Oceanpayment as a payment. This SDK aborts every one of them in a page it
+ * watches, so the agent's placeholder never reaches Oceanpayment. A GET (the page, its scripts, its log) continues.
+ *
+ * OCEANPAYMENT_HOSTS is payment-core's OCEANPAYMENT_HOSTS, and isOceanpaymentSendPay takes the URLs payment-core's
+ * isOceanpaymentSendPayUrl takes; oceanpayment.test.mjs pins both to payment-core.
+ */
+export const OCEANPAYMENT_PSP = 'oceanpayment';
+/** The dark-launch capability the API serves Oceanpayment's recognizer behind (payment-core processors/oceanpayment.js). */
+export const OCEANPAYMENT_CAPABILITY = 'oceanpayment_hosted_payment_page';
+/** The live host and Oceanpayment's sandbox, which serves the same page for a test terminal. */
+export const OCEANPAYMENT_HOSTS = Object.freeze(['secure.oceanpayment.com', 'test-secure.oceanpayment.com']);
+const SEND_PAY = /^\/gateway\/sendPay;jsessionid=[A-Za-z0-9._!-]{16,128}$/;
+// A session in the shape the recognizer takes, to ask whether this build's registry serves the card post on a host.
+const PROBE_SESSION = 'ARMEDPROBESESSION0';
+/** The Oceanpayment host a URL is on (https, no credentials, any port, any letter case, a trailing dot or not), or null. */
+function oceanpaymentHost(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== 'https:' || url.username || url.password)
+        return null;
+    const host = url.hostname.toLowerCase().replace(/\.$/, '');
+    return OCEANPAYMENT_HOSTS.includes(host) ? host : null;
+}
+/** Whether this URL is on one of Oceanpayment's two hosts. */
+export function isOceanpaymentHost(url) {
+    return oceanpaymentHost(url) !== null;
+}
+/**
+ * The only request on Oceanpayment's hosts that is the page's card post: a POST to exactly
+ * https://<host>/gateway/sendPay;jsessionid=<session>, as the page's form action writes it, with no port, query, fragment
+ * or other spelling (payment-core isOceanpaymentSendPayUrl takes the same strings). The post the SDK pauses.
+ */
+export function isOceanpaymentSendPay(url, method) {
+    if (String(method).toUpperCase() !== 'POST' || typeof url !== 'string' || url.includes('?') || url.includes('#'))
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    return parsed.href === url && parsed.protocol === 'https:' && !parsed.port && !parsed.username && !parsed.password
+        && OCEANPAYMENT_HOSTS.includes(parsed.hostname) && SEND_PAY.test(parsed.pathname);
+}
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on an Oceanpayment host and this build's
+ * registry serves Oceanpayment's card post there. Cardinal's call and a card post of another spelling are not the card
+ * post, so the registry's card-request test does not name them; the CDP adapter still pauses them through the
+ * recognizer's host pattern, and attachToPlaywright's route predicate asks this, so both adapters show the gates every
+ * request to Oceanpayment once Oceanpayment is armed.
+ */
+export function isArmedOceanpaymentUrl(vault, url) {
+    const host = oceanpaymentHost(url);
+    return host !== null && vault.isCardRequest(`https://${host}/gateway/sendPay;jsessionid=${PROBE_SESSION}`, 'POST');
+}

package/dist/paddle-tokenex.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: cb62940ac92ca9f2a61b5168f362003d67998f12d045b18d8bd07ae352e0cb3e
+// artifact-sha256: 4b24c682dbd8cd7bbaa0157f2932021d71f7c6802ce3814c6f3047173df29911
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,
@@ -429,9 +429,64 @@ function isPlainObject(v) {
     return !!v && typeof v === "object" && !Array.isArray(v);
 }
 var MAX_PATH_STEPS = 16;
+var MAX_TEXT_STEPS = 2;
+function isTextStep(step) {
+    return isPlainObject(step) && Object.keys(step).length === 1 && step.text === "json";
+}
+function sameStep(a, b) {
+    return a === b || isTextStep(a) && isTextStep(b);
+}
+function spellJson(parsed, form) {
+    const text = JSON.stringify(parsed);
+    if (form !== "php")
+        return text;
+    return text.replace(/\//g, "\\/").replace(/[\u0080-\uffff]/g, (unit) => `\\u${unit.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function jsonTextForm(value) {
+    if (typeof value !== "string" || !/^[[{]/.test(value))
+        return void 0;
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        return void 0;
+    }
+    if (parsed === null || typeof parsed !== "object")
+        return void 0;
+    for (const form of ["js", "php"]) {
+        try {
+            if (spellJson(parsed, form) === value)
+                return { parsed, form };
+        }
+        catch {
+            return void 0;
+        }
+    }
+    return void 0;
+}
+function jsonText(value) {
+    return jsonTextForm(value)?.parsed;
+}
 function isJsonPath(path) {
     return Array.isArray(path) && path.length <= MAX_PATH_STEPS && path.every((step) => typeof step === "string" ? step.length > 0 && !FORBIDDEN_KEYS.has(step) : Number.isSafeInteger(step) && step >= 0);
 }
+function isProfilePath(path) {
+    if (!Array.isArray(path) || path.length > MAX_PATH_STEPS)
+        return false;
+    let texts = 0;
+    for (const [i, step] of path.entries()) {
+        if (isTextStep(step)) {
+            texts += 1;
+            if (i === 0 || i === path.length - 1 || isTextStep(path[i - 1]) || texts > MAX_TEXT_STEPS)
+                return false;
+        }
+        else if (!isJsonPath([step])) {
+            return false;
+        }
+    }
+    return true;
+}
 function jsonAt(root, path) {
     let node = root;
     for (const step of path) {
@@ -446,6 +501,42 @@ function jsonAt(root, path) {
     }
     return { found: true, value: node };
 }
+function profileAt(root, path) {
+    if (!isProfilePath(path))
+        return { found: false };
+    let node = root;
+    for (const step of path) {
+        if (isTextStep(step)) {
+            const inner = jsonText(node);
+            if (inner === void 0)
+                return { found: false };
+            node = inner;
+            continue;
+        }
+        const at = jsonAt(node, [step]);
+        if (!at.found)
+            return { found: false };
+        node = at.value;
+    }
+    return { found: true, value: node };
+}
+function editAtProfilePath(root, path, edit) {
+    const at = profileAt(root, path);
+    if (!at.found || !isPlainObject(at.value))
+        return false;
+    const k = path.findIndex(isTextStep);
+    if (k === -1) {
+        edit(at.value);
+        return true;
+    }
+    const holder = jsonAt(root, path.slice(0, k - 1)).value;
+    const key = path[k - 1];
+    const text = jsonTextForm(holder[key]);
+    if (!text || !editAtProfilePath(text.parsed, path.slice(k + 1), edit))
+        return false;
+    holder[key] = spellJson(text.parsed, text.form);
+    return true;
+}
 function roundTrips(parsed, body) {
     try {
         return JSON.stringify(parsed) === body;
@@ -455,17 +546,17 @@ function roundTrips(parsed, body) {
     }
 }
 function sameSteps(a, b) {
-    return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((step, i) => step === b[i]);
+    return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((step, i) => sameStep(step, b[i]));
 }
 function pathsOverlap(a, b) {
     const n = Math.min(a.length, b.length);
     for (let i = 0; i < n; i += 1)
-        if (a[i] !== b[i])
+        if (!sameStep(a[i], b[i]))
             return false;
     return true;
 }
 function describePath(path) {
-    return path.length ? path.map((step) => typeof step === "number" ? `[${step}]` : `.${step}`).join("").replace(/^\./, "") : "(root)";
+    return path.length ? path.map((step) => typeof step === "number" ? `[${step}]` : isTextStep(step) ? "<json>" : `.${step}`).join("").replace(/^\./, "") : "(root)";
 }
 // src/substitution-primitives.js
 var SubstitutionError = class extends Error {
@@ -514,7 +605,7 @@ function swapMerchantHostedFields(body, spec, ciphertext = ADYEN_JWE) {
     const path = Array.isArray(spec.path) ? [...spec.path] : spec.path;
     const fields = isPlainObject(spec.fields) ? Object.fromEntries(Object.entries(spec.fields)) : null;
     const remove = Array.isArray(spec.remove) ? [...spec.remove] : spec.remove ?? [];
-    if (!isJsonPath(path))
+    if (!isProfilePath(path))
         throw new SubstitutionError("refusing substitution path");
     if (!fields || Object.keys(fields).length === 0)
         throw new SubstitutionError("substitutions carry no fields");
@@ -548,7 +639,7 @@ function swapMerchantHostedFields(body, spec, ciphertext = ADYEN_JWE) {
     }
     if (!isPlainObject(parsed))
         throw new SubstitutionError("the paused body is not a JSON object");
-    const holder = jsonAt(parsed, path);
+    const holder = profileAt(parsed, path);
     if (!holder.found || !isPlainObject(holder.value))
         throw new SubstitutionError(`the paused body has no object at ${describePath(path)}`);
     const swaps = /* @__PURE__ */ new Map();
@@ -600,15 +691,19 @@ function swapMerchantHostedFields(body, spec, ciphertext = ADYEN_JWE) {
     catch {
         throw new SubstitutionError("the substituted body is not JSON");
     }
-    const written = jsonAt(out, path);
+    const written = profileAt(out, path);
     if (!written.found || !isPlainObject(written.value) || names.some((name) => written.value[name] !== fields[name]) || dummies.some((dummy) => swapped.includes(dummy))) {
         throw new SubstitutionError(`the substitution did not land at ${describePath(path)}`);
     }
     if (remove.length === 0 && set.length === 0)
         return swapped;
-    for (const key of remove)
-        if (Object.prototype.hasOwnProperty.call(written.value, key))
-            delete written.value[key];
+    if (remove.length > 0 && !editAtProfilePath(out, path, (object) => {
+        for (const key of remove)
+            if (Object.prototype.hasOwnProperty.call(object, key))
+                delete object[key];
+    })) {
+        throw new SubstitutionError(`the substitution did not land at ${describePath(path)}`);
+    }
     for (const entry of set) {
         const parent = jsonAt(out, entry.path.slice(0, -1));
         if (!parent.found || !isPlainObject(parent.value))

package/dist/payplug.d.ts

@@ -0,0 +1,41 @@
+/**
+ * PayPlug's hosted payment page (secure.payplug.com, where French merchants send a buyer who pays by card), as this SDK
+ * reads it.
+ *
+ * The merchant's server creates the payment with PayPlug and sends the buyer's browser to the page's URL PayPlug answered
+ * with, https://secure.payplug.com/pay/<payment id>, or /pay/test/<payment id> for a test payment, by a redirect or by
+ * setting the page's location. PayPlug's Shopify app does the same from Shopify's checkout. That GET carries no card, no
+ * amount and no merchant, and it is the one request a build that declares PayPlug's capability pauses (hosted-entry.ts):
+ * the cardholder's device repeats it over the end-to-end TLS relay and pays on the page PayPlug returns to it (payment-core
+ * processors/payplug.js). Every step toward paying on that page is a POST to PayPlug's host, the page's card post among
+ * them, with the card encrypted under the page's own key.
+ *
+ * PAYPLUG_HOST is payment-core's PAYPLUG_HOST, and isPayplugEntryUrl is payment-core's isPayplugEntryUrl; payplug.test.mjs
+ * pins both to payment-core on every case payment-core's own tests list.
+ */
+export declare const PAYPLUG_PSP = "payplug";
+/** The dark-launch capability the API serves PayPlug's recognizer behind (payment-core processors/payplug.js). */
+export declare const PAYPLUG_CAPABILITY = "payplug_hosted_payment_page";
+/** PayPlug's page host, which its test and live payments share; the entry's path says which one a payment is. */
+export declare const PAYPLUG_HOST = "secure.payplug.com";
+/**
+ * Whether a URL is the payment page's URL exactly as PayPlug writes payment_url: https, secure.payplug.com in lower case,
+ * the default port, no credentials, no query and no fragment, not even an empty one, and the path /pay/<id> or
+ * /pay/test/<id> with the payment's 22-character id. The lightbox's ?lightbox=1, or any other query, asks PayPlug's page
+ * for something else, so it is not the entry, and neither is any other request to PayPlug's host.
+ */
+export declare function isPayplugEntryUrl(raw: unknown): boolean;
+/**
+ * Whether a request on PayPlug's page host is a step toward paying there: any POST, the page's card post and its
+ * 3-D Secure posts among them. The page itself, its scripts, its images and its frames are GETs of no card and are not one.
+ */
+export declare function isPayplugPayStep(url: string, method: string): boolean;
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on PayPlug's page host and this build's
+ * registry serves PayPlug's entry. The page's posts are not the entry, so the registry's card-request test does not name
+ * them; the CDP adapter still pauses them through the recognizer's host pattern, and attachToPlaywright's route predicate
+ * asks this, so both adapters show the gates every request to the page's host once PayPlug is armed.
+ */
+export declare function isArmedPayplugUrl(vault: {
+    isCardRequest(url: string, method?: string): boolean;
+} | undefined, url: string): boolean;

package/dist/payplug.js

@@ -0,0 +1,71 @@
+/**
+ * PayPlug's hosted payment page (secure.payplug.com, where French merchants send a buyer who pays by card), as this SDK
+ * reads it.
+ *
+ * The merchant's server creates the payment with PayPlug and sends the buyer's browser to the page's URL PayPlug answered
+ * with, https://secure.payplug.com/pay/<payment id>, or /pay/test/<payment id> for a test payment, by a redirect or by
+ * setting the page's location. PayPlug's Shopify app does the same from Shopify's checkout. That GET carries no card, no
+ * amount and no merchant, and it is the one request a build that declares PayPlug's capability pauses (hosted-entry.ts):
+ * the cardholder's device repeats it over the end-to-end TLS relay and pays on the page PayPlug returns to it (payment-core
+ * processors/payplug.js). Every step toward paying on that page is a POST to PayPlug's host, the page's card post among
+ * them, with the card encrypted under the page's own key.
+ *
+ * PAYPLUG_HOST is payment-core's PAYPLUG_HOST, and isPayplugEntryUrl is payment-core's isPayplugEntryUrl; payplug.test.mjs
+ * pins both to payment-core on every case payment-core's own tests list.
+ */
+export const PAYPLUG_PSP = 'payplug';
+/** The dark-launch capability the API serves PayPlug's recognizer behind (payment-core processors/payplug.js). */
+export const PAYPLUG_CAPABILITY = 'payplug_hosted_payment_page';
+/** PayPlug's page host, which its test and live payments share; the entry's path says which one a payment is. */
+export const PAYPLUG_HOST = 'secure.payplug.com';
+// The entry's path: /pay/<id> for a live payment, /pay/test/<id> for a test one, the id as PayPlug writes it.
+const ENTRY_PATH = /^\/pay\/(?:test\/)?[A-Za-z0-9]{22}$/;
+// An id of that shape, for asking whether this build's registry serves the entry.
+const PROBE = 'https://secure.payplug.com/pay/0000000000000000000000';
+/**
+ * Whether a URL is the payment page's URL exactly as PayPlug writes payment_url: https, secure.payplug.com in lower case,
+ * the default port, no credentials, no query and no fragment, not even an empty one, and the path /pay/<id> or
+ * /pay/test/<id> with the payment's 22-character id. The lightbox's ?lightbox=1, or any other query, asks PayPlug's page
+ * for something else, so it is not the entry, and neither is any other request to PayPlug's host.
+ */
+export function isPayplugEntryUrl(raw) {
+    if (typeof raw !== 'string' || raw.length > 256 || raw.includes('?') || raw.includes('#'))
+        return false;
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    if (url.href !== raw || url.protocol !== 'https:' || url.hostname !== PAYPLUG_HOST || url.port || url.username || url.password)
+        return false;
+    return ENTRY_PATH.test(url.pathname);
+}
+/** Whether a URL is on PayPlug's page host: https, no credentials, any port, any letter case, a trailing dot or not. */
+function onPayplugHost(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    return url.protocol === 'https:' && !url.username && !url.password && url.hostname.toLowerCase().replace(/\.$/, '') === PAYPLUG_HOST;
+}
+/**
+ * Whether a request on PayPlug's page host is a step toward paying there: any POST, the page's card post and its
+ * 3-D Secure posts among them. The page itself, its scripts, its images and its frames are GETs of no card and are not one.
+ */
+export function isPayplugPayStep(url, method) {
+    return onPayplugHost(url) && String(method).toUpperCase() === 'POST';
+}
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on PayPlug's page host and this build's
+ * registry serves PayPlug's entry. The page's posts are not the entry, so the registry's card-request test does not name
+ * them; the CDP adapter still pauses them through the recognizer's host pattern, and attachToPlaywright's route predicate
+ * asks this, so both adapters show the gates every request to the page's host once PayPlug is armed.
+ */
+export function isArmedPayplugUrl(vault, url) {
+    return onPayplugHost(url) && typeof vault?.isCardRequest === 'function' && vault.isCardRequest(PROBE, 'GET');
+}

package/dist/payrails.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 056fa54de953be9af775505906b2fba30def2787a217a12fe2ca2a50b8614649
+// artifact-sha256: 139d0001a168e053ebe3283721905ae95d7c159a25848469965f037b844a44cf
 // src/json-path.js
 function roundTrips(parsed, body) {
     try {
@@ -10,6 +10,25 @@ function roundTrips(parsed, body) {
         return false;
     }
 }
+// src/answer-card-leak.js
+var DECIMAL = /\p{Nd}/u;
+function digitValue(char) {
+    const point = char.codePointAt(0);
+    let first = point;
+    while (DECIMAL.test(String.fromCodePoint(first - 1)))
+        first -= 1;
+    return String((point - first) % 10);
+}
+var ENCLOSED = /* @__PURE__ */ Object.freeze([[9451, 10, 11], [9461, 10, 1], [9471, 1, 0], [10102, 30, 1], [127243, 2, 0]]);
+var ENCLOSED_CHAR = /[\u24eb-\u24ff\u2776-\u2793\u{1f10b}\u{1f10c}]/gu;
+function enclosedValue(char) {
+    const point = char.codePointAt(0);
+    const [first, , start] = ENCLOSED.find(([from, size]) => point >= from && point < from + size);
+    return String(first === 127243 ? 0 : first === 10102 ? (point - first) % 10 + 1 : start + point - first);
+}
+var asciiDigits = (text) => (typeof text.normalize === "function" ? text.normalize("NFKC") : text).replace(ENCLOSED_CHAR, enclosedValue).replace(/\p{Nd}/gu, (char) => char >= "0" && char <= "9" ? char : digitValue(char));
+var digitCount = (text) => (asciiDigits(String(text)).match(/\p{N}/gu) ?? []).length;
+var NAME_DIGITS = 3;
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,
@@ -139,7 +158,7 @@ function sha256Hex(input) {
         H[6] += g;
         H[7] += h;
     }
-    return Array.from(H, (word) => word.toString(16).padStart(8, "0")).join("");
+    return Array.from(H, (word2) => word2.toString(16).padStart(8, "0")).join("");
 }
 // src/rsa-pkcs1v15.js
 var RsaPkcs1v15Error = class extends Error {
@@ -652,6 +671,7 @@ var PAYRAILS_SERVED_CARD_FACTS = Object.freeze(["bin", "binLookup", "holderName"
 var exact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
 var bin6 = (value) => exact(/^[0-9]{6,8}$/, value) ? value.slice(0, 6) : void 0;
 var label = (value, max) => plainText(value, max) ? value : void 0;
+var word = (value, max, digits = 0) => plainText(value, max) && digitCount(value) <= digits ? value : void 0;
 var pick = (value, pattern) => exact(pattern, value) ? value : void 0;
 var compact = (object) => Object.fromEntries(Object.entries(object).filter(([, value]) => value !== void 0));
 var nonEmpty = (object) => Object.keys(object).length ? object : void 0;
@@ -691,13 +711,13 @@ function sanitizePayrailsResponse(text) {
         bin: served.has("bin") ? bin6(data.bin) : void 0,
         binLookup: lookup ? nonEmpty(compact({
             bin: bin6(lookup.bin),
-            network: label(lookup.network, 32),
-            issuer: label(lookup.issuer, 128),
-            issuerCountry: country ? nonEmpty(compact({ code: pick(country.code, /^[A-Z]{2}$/), name: label(country.name, 64), iso3: pick(country.iso3, /^[A-Z]{3}$/) })) : void 0,
-            type: label(lookup.type, 32)
+            network: word(lookup.network, 32),
+            issuer: word(lookup.issuer, 128, NAME_DIGITS),
+            issuerCountry: country ? nonEmpty(compact({ code: pick(country.code, /^[A-Z]{2}$/), name: word(country.name, 64), iso3: pick(country.iso3, /^[A-Z]{3}$/) })) : void 0,
+            type: word(lookup.type, 32)
         })) : void 0,
         holderName: served.has("holderName") ? label(data.holderName, 200) : void 0,
-        network: served.has("network") ? label(data.network, 32) : void 0,
+        network: served.has("network") ? word(data.network, 32) : void 0,
         suffix: data.suffix,
         expiryMonth: served.has("expiryMonth") ? pick(data.expiryMonth, /^(?:0[1-9]|1[0-2])$/) : void 0,
         expiryYear: served.has("expiryYear") ? pick(data.expiryYear, /^(?:[0-9]{2}|[0-9]{4})$/) : void 0

package/dist/payrexx.generated.js

@@ -1,6 +1,174 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 12336c60151bbdaa63f9d3e665fb53c8e3407ba942140bef2928e7ce3a8b3e2c
+// artifact-sha256: 5166082ae6c8f452fbcd2df5f679aa40e78fe7fc9f9dff20d9d50512ae7b4487
+// src/three-ds-step.js
+var RUN = /[A-Za-z0-9+/_-]{12,}/g;
+var RUN_LENGTH = 12;
+var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+var LAYERS = 2;
+var PAREQ = /pareq/i;
+var PAGE_PAREQ = /\bname\s*=\s*["']?[^"'\s>]*pareq/i;
+var THREE_DS_STEP_UNREADABLE = "unreadable_three_ds_step";
+var THREE_DS_STEP_HOLDS_CARD = "card_in_three_ds_step";
+var PERCENT_LAYERS = 8;
+function percentDecoded(text) {
+    let out = text;
+    for (let layer = 0; layer < PERCENT_LAYERS; layer += 1) {
+        const next = out.replace(/%([0-9A-Fa-f]{2})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
+        if (next === out)
+            break;
+        out = next;
+    }
+    return out;
+}
+var NAMED = /* @__PURE__ */ Object.freeze({
+    amp: "&",
+    percnt: "%",
+    num: "#",
+    quest: "?",
+    semi: ";",
+    excl: "!",
+    dollar: "$",
+    lpar: "(",
+    rpar: ")",
+    ast: "*",
+    comma: ",",
+    commat: "@",
+    lsqb: "[",
+    rsqb: "]",
+    lcub: "{",
+    rcub: "}",
+    verbar: "|",
+    bsol: "\\",
+    hat: "^",
+    grave: "`",
+    plus: "+",
+    sol: "/",
+    equals: "=",
+    lowbar: "_",
+    period: ".",
+    colon: ":",
+    quot: '"',
+    apos: "'",
+    lt: "<",
+    gt: ">"
+});
+var NUMERIC = "#(?:[xX]([0-9a-fA-F]+)|([0-9]+));?";
+var BARE_NAME = "(sup[123]|frac(?:12|14|34)|[A-Za-z]+);?";
+var referenceText = (hex, decimal, name) => {
+    if (name !== void 0)
+        return Object.prototype.hasOwnProperty.call(NAMED, name.toLowerCase()) ? NAMED[name.toLowerCase()] : " ";
+    const point = hex === void 0 ? parseInt(decimal, 10) : parseInt(hex, 16);
+    return point <= 1114111 ? String.fromCodePoint(point) : "";
+};
+function referenceReadings(text) {
+    const read = (pattern) => text.replace(new RegExp(`&(?:${NUMERIC}|${pattern})`, "g"), (_, hex, decimal, name) => referenceText(hex, decimal, name));
+    return [read("([A-Za-z][A-Za-z0-9]*);"), read(BARE_NAME)];
+}
+function readings(text) {
+    const out = /* @__PURE__ */ new Set([text, percentDecoded(text)]);
+    for (const reading of [...out])
+        for (const decoded of referenceReadings(reading))
+            out.add(decoded).add(percentDecoded(decoded));
+    return out;
+}
+function base64Bytes(run, skip) {
+    let bits = 0;
+    let value = 0;
+    let out = "";
+    for (let i = skip; i < run.length; i += 1) {
+        const char = run[i];
+        value = value << 6 | (char === "-" ? 62 : char === "_" ? 63 : ALPHABET.indexOf(char));
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            out += String.fromCharCode(value >> bits);
+            value &= (1 << bits) - 1;
+        }
+    }
+    return out;
+}
+var compressed = (bytes) => bytes.charCodeAt(0) === 31 && bytes.charCodeAt(1) === 139 || bytes.charCodeAt(0) === 120 && (30720 + bytes.charCodeAt(1)) % 31 === 0;
+function holdsStream(text, layers) {
+    for (const reading of readings(text)) {
+        for (const [run] of reading.matchAll(RUN)) {
+            const starts = [0];
+            for (let slash = run.indexOf("/"); slash >= 0; slash = run.indexOf("/", slash + 1))
+                starts.push(slash + 1);
+            if (starts.some((start) => run.length - start >= RUN_LENGTH && compressed(base64Bytes(run.slice(start, start + 4), 0))))
+                return true;
+            for (let skip = 0; layers > 0 && skip < 4; skip += 1)
+                if (holdsStream(base64Bytes(run, skip), layers - 1))
+                    return true;
+        }
+    }
+    return false;
+}
+function numberPattern(card) {
+    const number = card && (typeof card.number === "string" || typeof card.number === "number") ? String(card.number).replace(/[^0-9]/g, "") : "";
+    return number.length >= 12 && number.length <= 19 ? new RegExp(number.split("").join("[^0-9A-Za-z]{0,3}")) : null;
+}
+function holdsNumber(text, pattern, layers) {
+    for (const reading of readings(text)) {
+        if (pattern.test(reading))
+            return true;
+        if (layers === 0)
+            continue;
+        for (const [run] of reading.matchAll(RUN)) {
+            for (let skip = 0; skip < 4; skip += 1)
+                if (holdsNumber(base64Bytes(run, skip), pattern, layers - 1))
+                    return true;
+        }
+    }
+    return false;
+}
+function addressTexts(value) {
+    if (typeof value !== "string")
+        return null;
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return null;
+    }
+    const names = [];
+    const texts = [value, ...url.pathname.split("/")];
+    for (const pair of `${url.search.slice(1)}&${url.hash.slice(1)}`.split("&")) {
+        if (pair === "")
+            continue;
+        const at = pair.indexOf("=");
+        names.push(at < 0 ? pair : pair.slice(0, at));
+        if (at >= 0)
+            texts.push(pair.slice(at + 1));
+    }
+    return { names, texts: [...texts, ...names] };
+}
+var textOf = (value) => typeof value === "string" ? value : JSON.stringify(value) ?? "";
+function threeDsStepLeak(card, step) {
+    const names = [];
+    const texts = [];
+    for (const url of step.urls ?? []) {
+        const address = addressTexts(url);
+        if (!address)
+            return THREE_DS_STEP_UNREADABLE;
+        names.push(...address.names);
+        texts.push(...address.texts);
+    }
+    for (const [name, value] of step.fields ?? []) {
+        names.push(textOf(name));
+        texts.push(textOf(name), textOf(value));
+    }
+    for (const page of step.pages ?? []) {
+        if ([...readings(textOf(page))].some((reading) => PAGE_PAREQ.test(reading)))
+            return THREE_DS_STEP_UNREADABLE;
+        texts.push(textOf(page));
+    }
+    if (names.some((name) => [...readings(name)].some((reading) => PAREQ.test(reading))) || texts.some((text) => holdsStream(text, LAYERS)))
+        return THREE_DS_STEP_UNREADABLE;
+    const pattern = numberPattern(card);
+    return pattern && texts.some((text) => holdsNumber(text, pattern, LAYERS)) ? THREE_DS_STEP_HOLDS_CARD : null;
+}
 // src/payrexx.js
 var PAYREXX_PSP = "payrexx";
 var PAYREXX_CAPABILITY = "payrexx_card_frame";
@@ -287,8 +455,14 @@ function payrexxAnswerOutcome(status, text, card) {
             return { outcome: "refused", code: "payrexx_three_ds_declined" };
         if (step === "tokenless")
             return { outcome: "refused", code: "payrexx_three_ds_error" };
-        if (step !== null)
+        if (step !== null) {
+            const urls = [answer.threeDSMethodURL, answer.acsURL].filter((url) => typeof url === "string" && url !== "");
+            const members = Object.entries(answer).map(([key, value]) => [key, typeof value === "string" ? value : ""]);
+            const leak = threeDsStepLeak(card, { urls, fields: [...members, ["", text]] });
+            if (leak)
+                return { outcome: "unknown", reason: leak === THREE_DS_STEP_UNREADABLE ? "payrexx_three_ds_unreadable" : "payrexx_card_in_answer" };
             return { outcome: "approved", body: text, pending: "three_ds" };
+        }
     }
     return { outcome: "unknown", reason: "payrexx_answer_unconfirmed" };
 }