@agent-cards/sdk 0.23.28 → 0.24.0

package/dist/adyen-merchant-hosted.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: e15beada28ae21bc7d0145bea84f12379a45a8815f0cbb1405a2a78b14b34e4f
+// artifact-sha256: 86399b941b10d14455119f42141475bdcd524b5e55375ca1e2d3d82548076ecd
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -16,9 +16,65 @@ function isPlainObject(v) {
     return !!v && typeof v === "object" && !Array.isArray(v);
 }
 var MAX_PATH_STEPS = 16;
+var MAX_TEXT_STEPS = 2;
+var TEXT_STEP = /* @__PURE__ */ Object.freeze({ text: "json" });
+function isTextStep(step) {
+    return isPlainObject(step) && Object.keys(step).length === 1 && step.text === "json";
+}
+function sameStep(a, b) {
+    return a === b || isTextStep(a) && isTextStep(b);
+}
+function spellJson(parsed, form) {
+    const text = JSON.stringify(parsed);
+    if (form !== "php")
+        return text;
+    return text.replace(/\//g, "\\/").replace(/[\u0080-\uffff]/g, (unit) => `\\u${unit.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function jsonTextForm(value) {
+    if (typeof value !== "string" || !/^[[{]/.test(value))
+        return void 0;
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        return void 0;
+    }
+    if (parsed === null || typeof parsed !== "object")
+        return void 0;
+    for (const form of ["js", "php"]) {
+        try {
+            if (spellJson(parsed, form) === value)
+                return { parsed, form };
+        }
+        catch {
+            return void 0;
+        }
+    }
+    return void 0;
+}
+function jsonText(value) {
+    return jsonTextForm(value)?.parsed;
+}
 function isJsonPath(path) {
     return Array.isArray(path) && path.length <= MAX_PATH_STEPS && path.every((step) => typeof step === "string" ? step.length > 0 && !FORBIDDEN_KEYS.has(step) : Number.isSafeInteger(step) && step >= 0);
 }
+function isProfilePath(path) {
+    if (!Array.isArray(path) || path.length > MAX_PATH_STEPS)
+        return false;
+    let texts = 0;
+    for (const [i, step] of path.entries()) {
+        if (isTextStep(step)) {
+            texts += 1;
+            if (i === 0 || i === path.length - 1 || isTextStep(path[i - 1]) || texts > MAX_TEXT_STEPS)
+                return false;
+        }
+        else if (!isJsonPath([step])) {
+            return false;
+        }
+    }
+    return true;
+}
 function jsonAt(root, path) {
     let node = root;
     for (const step of path) {
@@ -33,6 +89,25 @@ function jsonAt(root, path) {
     }
     return { found: true, value: node };
 }
+function profileAt(root, path) {
+    if (!isProfilePath(path))
+        return { found: false };
+    let node = root;
+    for (const step of path) {
+        if (isTextStep(step)) {
+            const inner = jsonText(node);
+            if (inner === void 0)
+                return { found: false };
+            node = inner;
+            continue;
+        }
+        const at = jsonAt(node, [step]);
+        if (!at.found)
+            return { found: false };
+        node = at.value;
+    }
+    return { found: true, value: node };
+}
 function roundTrips(parsed, body) {
     try {
         return JSON.stringify(parsed) === body;
@@ -44,7 +119,7 @@ function roundTrips(parsed, body) {
 function pathsOverlap(a, b) {
     const n = Math.min(a.length, b.length);
     for (let i = 0; i < n; i += 1)
-        if (a[i] !== b[i])
+        if (!sameStep(a[i], b[i]))
             return false;
     return true;
 }
@@ -56,7 +131,12 @@ function valuesIgnoringCase(root, path) {
     for (const step of path) {
         const next = [];
         for (const node of nodes) {
-            if (typeof step === "number") {
+            if (isTextStep(step)) {
+                const inner = jsonText(node);
+                if (inner !== void 0)
+                    next.push(inner);
+            }
+            else if (typeof step === "number") {
                 if (Array.isArray(node) && Number.isSafeInteger(step) && step >= 0 && step < node.length)
                     next.push(node[step]);
             }
@@ -71,7 +151,7 @@ function valuesIgnoringCase(root, path) {
     return nodes;
 }
 function describePath(path) {
-    return path.length ? path.map((step) => typeof step === "number" ? `[${step}]` : `.${step}`).join("").replace(/^\./, "") : "(root)";
+    return path.length ? path.map((step) => typeof step === "number" ? `[${step}]` : isTextStep(step) ? "<json>" : `.${step}`).join("").replace(/^\./, "") : "(root)";
 }
 // src/url-template.js
 var PLACEHOLDER_VALUE = /^[A-Za-z0-9._~@+-]{1,256}$/;
@@ -316,6 +396,7 @@ function listRefusal(list, max, label, each, { optional = true, min = 0 } = {})
     return null;
 }
 var pathRefusal = (path, label) => isJsonPath(path) && path.length > 0 ? null : `${label} is not a JSON path of keys and indices`;
+var bodyPathRefusal = (path, label) => isProfilePath(path) && path.length > 0 ? null : `${label} is not a JSON path of keys and indices`;
 function equalsRuleRefusal(rule, label, { root }) {
     const byPath = root && isPlainObject(rule) && has(rule, "equalsPath");
     if (byPath && has(rule, "equals"))
@@ -755,11 +836,11 @@ function merchantBodyAmountRefusal(profile) {
     if (amount === null)
         return null;
     if (Array.isArray(amount))
-        return pathRefusal(amount, "the body amount");
+        return bodyPathRefusal(amount, "the body amount");
     const members = membersRefusal(amount, BODY_AMOUNT_MEMBERS, BODY_AMOUNT_MEMBERS, "the body amount");
     if (members)
         return members;
-    const paths = pathRefusal(amount.value, "the body amount's value") ?? pathRefusal(amount.currency, "the body amount's currency");
+    const paths = bodyPathRefusal(amount.value, "the body amount's value") ?? bodyPathRefusal(amount.currency, "the body amount's currency");
     if (paths)
         return paths;
     if (pathsOverlap(amount.value, amount.currency))
@@ -780,16 +861,16 @@ function readMerchantBodyAmount(profile, body) {
     if (amount === null)
         return { kind: "unnamed" };
     if (Array.isArray(amount)) {
-        const at = jsonAt(body, amount);
+        const at = profileAt(body, amount);
         if (!at.found)
             return { kind: "absent" };
         const named = adyenAmount(at.value);
         return named ? { kind: "amount", amountCents: named.minor, currency: named.currency } : { kind: "unreadable" };
     }
-    const value = jsonAt(body, amount.value);
+    const value = profileAt(body, amount.value);
     if (!value.found)
         return { kind: "absent" };
-    const currency = jsonAt(body, amount.currency);
+    const currency = profileAt(body, amount.currency);
     if (!currency.found || typeof currency.value !== "string" || !/^[A-Za-z]{3}$/.test(currency.value))
         return { kind: "unreadable" };
     const code = currency.value.toUpperCase();
@@ -1542,6 +1623,289 @@ var MERCHANT_HOSTED_PROFILES = /* @__PURE__ */ deepFreeze([
         facts: [{ path: ["sign_request", "raw_card_bin"], fact: "bin6" }],
         then: { method: "POST", path: "/cpp-paypage/v1/miles-plus-cash-authorise", query: {}, holder: [] },
         adyen: { environment: "live", clientKey: null, publicKeySha256: null }
+    },
+    {
+        // Read Oct 23, 2026, from teenage.engineering's shipped code and a card-free observe run on its
+        // US checkout (every non-GET aborted once the card form was reached, the placeholder typed into
+        // adyen-web's secured fields, nothing pressed). The store runs on Centra. Its checkout posts the
+        // order form to /_api/mw/selections/<selection>/payment2 with paymentInitiateOnly (no card), and
+        // Centra answers with the Adyen Drop-in's own script (adyen-web 6.41.1, environment live, this
+        // client key, holder name required, enableStoreDetails false). That script's onSubmit hands
+        // adyen-web's state.data to the page as paymentMethodSpecificFields (centra_checkout_payment_callback),
+        // and the page's finishAdyenPayment (assets/shop.*.js, cart-api.*.js) posts
+        // {paymentMethod: 'adyen-drop-in', address: <billing address>, paymentMethodSpecificFields:
+        // state.data, termsAndConditions: true, affiliate} to the same path through fetch, with no
+        // content type of its own (text/plain;charset=UTF-8 on the wire, a JSON text). The body names no
+        // amount: Centra charges the selection the path names, so the total comes from the selection's
+        // own answers below. The Drop-in's stored-payment update flow adds contracts. Public key read
+        // from checkoutshopper-live.adyen.com on 2026-10-23 (UTC). Not yet seen on the wire: the card
+        // request itself, which leaves only on the Pay press, so a press run confirms the body.
+        id: "teenage_engineering_centra_payment",
+        merchant: "teenage engineering",
+        status: "observe",
+        origins: [{ checkout: "https://teenage.engineering", endpoint: "https://teenage.engineering" }],
+        method: "POST",
+        path: "/_api/mw/selections/:selectionId/payment2",
+        query: {},
+        requires: [{ path: ["paymentMethod"], equals: "adyen-drop-in" }],
+        holder: ["paymentMethodSpecificFields", "paymentMethod"],
+        fields: {
+            encryptedCardNumber: "encryptedCardNumber",
+            encryptedExpiryMonth: "encryptedExpiryMonth",
+            encryptedExpiryYear: "encryptedExpiryYear",
+            encryptedSecurityCode: "encryptedSecurityCode"
+        },
+        // adyen-web 6.x stamps the dummy's brand after its bin lookup answers.
+        remove: ["brand"],
+        refuse: [
+            { path: ["paymentMethodSpecificFields", "storePaymentMethod"], when: "true" },
+            { path: ["paymentMethodSpecificFields", "paymentMethod", "storedPaymentMethodId"], when: "present" },
+            { path: ["paymentMethodSpecificFields", "paymentMethod", "recurringDetailReference"], when: "present" },
+            // The order form's own post on the same path initiates the payment and carries no card.
+            { path: ["paymentInitiateOnly"], when: "true" },
+            // The Drop-in's stored-payment update flow names subscription contracts the card would pay later.
+            { path: ["contracts"], when: "present" }
+        ],
+        amount: null,
+        // Read Oct 23, 2026 (the observe run above). Every selection call answers the whole selection
+        // as JSON: the read, the country and VAT changes, item quantities and the address step (which
+        // wraps it in `selection`). totals.grandTotalPriceAsNumber is what the Drop-in tells its own
+        // wallets to charge, in major units (2497.29 in the run), and currency names the currency. The
+        // card request's URL carries the same selection id, which binds each answer to it. Voucher,
+        // VAT-number and item-removal answers were not seen in the run, so they are not read: any of
+        // those calls after the chosen answer makes it stale.
+        amountSource: {
+            id: "teenage_engineering_selection_totals",
+            origin: "endpoint",
+            format: "json",
+            responses: [
+                { method: "GET", path: "/_api/mw/selections/:selectionId", query: {} },
+                { method: "PUT", path: "/_api/mw/selections/:selectionId", query: {} },
+                { method: "PUT", path: "/_api/mw/selections/:selectionId/address", query: {}, at: ["selection"] },
+                { method: "DELETE", path: "/_api/mw/selections/:selectionId/vat", query: {} },
+                { method: "POST", path: "/_api/mw/selections/:selectionId/items/:itemId/quantity/:quantity", query: {} },
+                { method: "DELETE", path: "/_api/mw/selections/:selectionId/items/:itemId/quantity/:quantity", query: {} }
+            ],
+            total: { path: ["totals", "grandTotalPriceAsNumber"], format: "number" },
+            unit: "major",
+            currency: "USD",
+            currencyPath: ["currency"],
+            bind: [{ placeholder: "selectionId", cardPlaceholder: "selectionId" }],
+            voidedBy: [
+                { method: "POST", path: "/_api/mw/selections/:selectionId/vouchers/:voucherCode", query: {} },
+                { method: "DELETE", path: "/_api/mw/selections/:selectionId/vouchers", query: {} },
+                { method: "POST", path: "/_api/mw/selections/:selectionId/vat/:vatNumber", query: {} },
+                { method: "DELETE", path: "/_api/mw/selections/:selectionId/items/:itemId", query: {} }
+            ],
+            maxAgeMs: 9e5
+        },
+        adyen: {
+            environment: "live",
+            clientKey: "live_FAQ7CUZM7JAO7K6CGXI67KMZ64K35AVH",
+            publicKeySha256: "b99a44120544b609c01ede6041c82b481d23423d7e956355022a5d7f362b5349"
+        }
+    },
+    {
+        // Read Oct 23, 2026, from www.scheels.com's shipped checkout chunk (a Next.js page on commercetools
+        // Frontastic) and a card-free observe run on its guest checkout (every non-GET aborted once the card
+        // form was reached, the placeholder typed into adyen-web 5.5.3's secured fields, Review Order pressed:
+        // the address save before it was aborted too, so the card request was not reached). The Card
+        // component's onSubmit (showPayButton false; the page submits it on Review Order) sets
+        // state.data.paymentMethod.brand from onBrand, then calls the Frontastic action
+        // /cart/setAdyenCreditCard with {payment: {paymentMethod: 'CREDIT_CARD', bin (onBinValue's six
+        // digits, or onFieldValid's issuerBin), lastFour (onFieldValid's endDigits), deviceFingerprint (when
+        // the page has one)}, state: JSON.stringify(state)}. The SDK posts JSON.stringify(payload) to
+        // apihub.scheels.com/frontastic/action/cart/setAdyenCreditCard (its path joiner collapses the
+        // action's leading '/') with content-type application/json and the Frontastic-Session header. So the
+        // four JWEs sit in adyen-web's state, inside the `state` text. bin and lastFour describe the dummy:
+        // the approved card's BIN6 and last four are written there. The body names no amount: the cart the
+        // session holds is charged when Place Order sends cart/checkout, which carries no card. Public key
+        // read from checkoutshopper-live-us.adyen.com on 2026-10-23 (UTC).
+        id: "scheels_frontastic_adyen_card",
+        merchant: "SCHEELS",
+        status: "observe",
+        origins: [{ checkout: "https://www.scheels.com", endpoint: "https://apihub.scheels.com" }],
+        method: "POST",
+        path: "/frontastic/action/cart/setAdyenCreditCard",
+        query: {},
+        requires: [{ path: ["payment", "paymentMethod"], equals: "CREDIT_CARD" }],
+        holder: ["state", TEXT_STEP, "data", "paymentMethod"],
+        fields: {
+            encryptedCardNumber: "encryptedCardNumber",
+            encryptedExpiryMonth: "encryptedExpiryMonth",
+            encryptedExpiryYear: "encryptedExpiryYear",
+            encryptedSecurityCode: "encryptedSecurityCode"
+        },
+        // The page copies onBrand's code (the dummy's) into the state before it is stringified.
+        remove: ["brand"],
+        refuse: [
+            // enableStoreDetails is on for a signed-in shopper only.
+            { path: ["state", TEXT_STEP, "data", "storePaymentMethod"], when: "true" },
+            { path: ["state", TEXT_STEP, "data", "paymentMethod", "storedPaymentMethodId"], when: "present" },
+            { path: ["state", TEXT_STEP, "data", "paymentMethod", "recurringDetailReference"], when: "present" }
+        ],
+        amount: null,
+        // Read Oct 23, 2026 (the observe run above). Every cart action on the checkout page answers the
+        // whole cart, camelCase JSON at the root (addToCart wraps it in `cart`); summary.amountDue is what
+        // the payment step shows as "Amount due" and what is left for the card, in cents (6538 in the run,
+        // the run's total). The cart is the session's, so an answer is tied to the card request by its
+        // page. A gift card or another tender lowers the amount due below the order's gross total and is
+        // refused until a HAR shows which one the charge follows.
+        amountSource: {
+            id: "scheels_cart_amount_due",
+            origin: "endpoint",
+            format: "json",
+            responses: [
+                { method: "POST", path: "/frontastic/action/cart/updateCart", query: {} },
+                { method: "POST", path: "/frontastic/action/cart/setCheckoutDefaults", query: {} },
+                { method: "POST", path: "/frontastic/action/cart/clean", query: {} },
+                { method: "POST", path: "/frontastic/action/cart/addToCart", query: {}, at: ["cart"] },
+                { method: "POST", path: "/frontastic/action/route/addRouteProtection", query: {} },
+                { method: "POST", path: "/frontastic/action/route/removeRouteProtection", query: {} }
+            ],
+            total: { path: ["summary", "amountDue", "centAmount"], format: "number" },
+            unit: "minor",
+            currency: "USD",
+            currencyPath: ["summary", "amountDue", "currencyCode"],
+            bind: [{ samePage: true }],
+            requires: [{ path: ["summary", "amountDue", "centAmount"], equalsPath: ["summary", "grossTotal", "centAmount"] }],
+            refuse: [
+                { path: ["summary", "giftCardTotal", "centAmount"], when: "nonzero" },
+                { path: ["summary", "tenderTotal", "centAmount"], when: "nonzero" }
+            ],
+            // Cart changes whose answers were not seen in the run: any of them after the chosen answer makes it stale.
+            voidedBy: [
+                { method: "POST", path: "/frontastic/action/cart/redeemDiscountCode", query: {} },
+                { method: "POST", path: "/frontastic/action/cart/removeDiscountCode", query: {} },
+                { method: "POST", path: "/frontastic/action/cart/updateItem", query: {} },
+                { method: "POST", path: "/frontastic/action/cart/removeItem", query: {} },
+                { method: "POST", path: "/frontastic/action/cart/setShippingMethod", query: {} },
+                { method: "POST", path: "/frontastic/action/sameDay/setTip", query: {} }
+            ],
+            maxAgeMs: 9e5
+        },
+        facts: [
+            { path: ["payment", "bin"], fact: "bin6" },
+            { path: ["payment", "lastFour"], fact: "last4" }
+        ],
+        adyen: {
+            environment: "live-us",
+            clientKey: "live_7NQ5GGRX7ZD3PJCWBGV6WELTMMA3GBOO",
+            publicKeySha256: "9d6aa672c539f6e76c082beed1fcbe089af526b87c9ea6878ab3671355089065"
+        }
+    },
+    {
+        // Read Oct 23, 2026, from www.buff.com's shipped US checkout (Magento on Hyvä Checkout with
+        // Magewire, Adyen's Hyvä module, adyen-web 5.5.3) and a card-free observe run on its guest checkout
+        // (every non-GET aborted once the card form was reached, the placeholder typed into the secured
+        // fields, nothing pressed). The card renderer keeps adyen-web's state.data from onChange and the
+        // brand code onBrand maps (amex AE, visa VI, mc MC). Place Order calls the adyen_cc component's
+        // placeOrder({stateData, ccType, publicHash: null, extension_attributes}) through Magewire, which
+        // posts JSON.stringify({fingerprint, serverMemo, updates: [{type: 'callMethod', payload: {id,
+        // method: 'placeOrder', params: [that object]}}]}) to
+        // /us/magewire/post/livewire/message/checkout.payment.methods.adyen_cc with content-type
+        // application/json and X-CSRF-TOKEN. The server charges the quote there. ccType describes the
+        // dummy: the approved card's code is written there. The body's own serverMemo, which Magewire signs
+        // with its checksum, carries the component's paymentResponse as JSON text, and its
+        // paymentMethodsExtraDetails.scheme.configuration.amount is the quote's grand total in cents: it
+        // followed the run's total from 8600 to 9342 once shipping and tax were set. A saved card sends a
+        // publicHash and enableStoreDetails is off for a guest. Public key read from
+        // checkoutshopper-live.adyen.com on 2026-10-23 (UTC). Not yet seen on the wire: the card request
+        // itself, which leaves only on Place Order.
+        id: "buff_magewire_adyen_cc",
+        merchant: "Buff",
+        status: "observe",
+        origins: [{ checkout: "https://www.buff.com", endpoint: "https://www.buff.com" }],
+        method: "POST",
+        path: "/us/magewire/post/livewire/message/checkout.payment.methods.adyen_cc",
+        query: {},
+        requires: [
+            { path: ["fingerprint", "name"], equals: "checkout.payment.methods.adyen_cc" },
+            { path: ["updates", 0, "type"], equals: "callMethod" },
+            { path: ["updates", 0, "payload", "method"], equals: "placeOrder" }
+        ],
+        holder: ["updates", 0, "payload", "params", 0, "stateData", "paymentMethod"],
+        fields: {
+            encryptedCardNumber: "encryptedCardNumber",
+            encryptedExpiryMonth: "encryptedExpiryMonth",
+            encryptedExpiryYear: "encryptedExpiryYear",
+            encryptedSecurityCode: "encryptedSecurityCode"
+        },
+        // adyen-web 5.x stamps the dummy's brand into state.data.
+        remove: ["brand"],
+        refuse: [
+            // One call per message: a second update or a second argument is not the reviewed request.
+            { path: ["updates", 1], when: "present" },
+            { path: ["updates", 0, "payload", "params", 1], when: "present" },
+            // A saved card's public hash, or a card kept for later.
+            { path: ["updates", 0, "payload", "params", 0, "publicHash"], when: "true" },
+            { path: ["updates", 0, "payload", "params", 0, "stateData", "storePaymentMethod"], when: "true" },
+            { path: ["updates", 0, "payload", "params", 0, "stateData", "paymentMethod", "storedPaymentMethodId"], when: "present" },
+            { path: ["updates", 0, "payload", "params", 0, "stateData", "paymentMethod", "recurringDetailReference"], when: "present" }
+        ],
+        amount: ["serverMemo", "data", "paymentResponse", TEXT_STEP, "paymentMethodsExtraDetails", "scheme", "configuration", "amount"],
+        facts: [
+            // The renderer's own map (componentHandler.getCcCodeByAltCode); Buff's card list names these three.
+            { path: ["updates", 0, "payload", "params", 0, "ccType"], fact: "brand", map: { visa: "VI", mastercard: "MC", amex: "AE" } }
+        ],
+        adyen: {
+            environment: "live",
+            clientKey: "live_5NIC7BWSNFDX3GBSKL5XCZ4B4YCIWLKP",
+            publicKeySha256: "3f7e1740684cb4964aa8bb7185b9718564fc0957cfc83e096f7bf016d6a7d001"
+        }
+    },
+    {
+        // Read Oct 23, 2026, from www.plein.com's shipped US checkout (Salesforce Commerce Cloud SiteGenesis with Adyen's
+        // int_adyen cartridge, adyen-web 4.9.0) and the press lane's stored copy of the card request the page sent with the
+        // placeholder typed (aborted unsent by the checkout SDK's hold; values sanitized, field names and shape kept). The
+        // card component's onSubmit writes JSON.stringify(state.data) into the hidden field dwfrm_adyPaydata_adyenStateData,
+        // and CONTINUE TO PLACE ORDER submits the billing form: a top-level form post (application/x-www-form-urlencoded) to
+        // /us/billing/. So the four JWEs sit in adyen-web's state, inside that field's JSON text, under paymentMethod
+        // (adyen-web 4.9 writes no brand there; one a later version writes is dropped). Beside the state the page writes
+        // onBrand's code into dwfrm_billing_paymentMethods_creditCard_type and twelve '*' with onFieldValid's last four into
+        // dwfrm_billing_paymentMethods_creditCard_number, both describing the dummy: the approved card's are written there.
+        // The form also carries its csrf_token and its submit button's name twice (dwfrm_billing_save); a repeated field
+        // never reaches a rule. enableStoreDetails is on for a signed-in shopper only. The body names no amount, and the
+        // page's total sits only in its analytics block (tc_vars.order_amount_ati_with_sf), which no reviewed rule reads,
+        // so amountPending holds the profile in observe. Public key read from checkoutshopper-live-us.adyen.com on
+        // 2026-10-23 (UTC).
+        id: "plein_sfcc_billing_form",
+        merchant: "Philipp Plein",
+        status: "observe",
+        origins: [{ checkout: "https://www.plein.com", endpoint: "https://www.plein.com" }],
+        method: "POST",
+        path: "/us/billing/",
+        query: {},
+        encoding: "form",
+        requires: [
+            { path: ["dwfrm_billing_paymentMethods_selectedPaymentMethodID"], equals: "AdyenComponent" },
+            { path: ["brandCode"], equals: "scheme" }
+        ],
+        holder: ["dwfrm_adyPaydata_adyenStateData", TEXT_STEP, "paymentMethod"],
+        fields: {
+            encryptedCardNumber: "encryptedCardNumber",
+            encryptedExpiryMonth: "encryptedExpiryMonth",
+            encryptedExpiryYear: "encryptedExpiryYear",
+            encryptedSecurityCode: "encryptedSecurityCode"
+        },
+        remove: ["brand"],
+        refuse: [
+            { path: ["dwfrm_adyPaydata_adyenStateData", TEXT_STEP, "storePaymentMethod"], when: "true" },
+            { path: ["dwfrm_adyPaydata_adyenStateData", TEXT_STEP, "paymentMethod", "storedPaymentMethodId"], when: "present" },
+            { path: ["dwfrm_adyPaydata_adyenStateData", TEXT_STEP, "paymentMethod", "recurringDetailReference"], when: "present" }
+        ],
+        amount: null,
+        amountPending: "the page names its total only in its analytics block (tc_vars.order_amount_ati_with_sf), which no reviewed rule reads",
+        facts: [
+            // onBrand's adyen-web codes for the networks a US checkout takes.
+            { path: ["dwfrm_billing_paymentMethods_creditCard_type"], fact: "brand", map: { visa: "visa", mastercard: "mc", amex: "amex", discover: "discover" } },
+            { path: ["dwfrm_billing_paymentMethods_creditCard_number"], fact: "masked_last4" }
+        ],
+        adyen: {
+            environment: "live-us",
+            clientKey: "live_P7RRXHAHEVFTLPS3XUD3ML7ZWUEZ6BXN",
+            publicKeySha256: "3e0d4366563b714feb233d12ce98adcef3b606381596e097ca3a8123b9a91d67"
+        }
     }
 ]);
 function adyenKeyHost(environment) {
@@ -1617,23 +1981,80 @@ function declaredEndpointRefusal(endpoint) {
         return `${url.hostname} belongs to a merchant Agentcard reviewed, so it cannot be declared`;
     return null;
 }
-function merchantBodyRefusal(profile, body) {
-    const p = merchantProfileRecognizerById(typeof profile === "string" ? profile : profile?.id);
-    if (!p)
-        throw new Error("Refusing to pay: unknown merchant profile.");
+function textRefusal(p, parsed) {
+    const amount = p.amount;
+    const amountPaths = Array.isArray(amount) ? [amount] : isPlainObject(amount) ? [amount.value, amount.currency] : [];
+    const paths = [p.holder, ...p.requires.map((rule) => rule.path), ...p.refuse.map((rule) => rule.path), ...amountPaths].filter(Array.isArray);
+    for (const path of paths) {
+        for (const [k, step] of path.entries()) {
+            if (!isTextStep(step))
+                continue;
+            const before = path.slice(0, k);
+            if (valuesIgnoringCase(parsed, before).some((value) => valuesIgnoringCase(value, [TEXT_STEP]).length === 0)) {
+                return `the paused body's ${describePath(before)} is not JSON text written the way JSON.stringify or PHP's json_encode writes it, so ${p.merchant}'s rules cannot read it`;
+            }
+        }
+    }
+    return null;
+}
+function formBodyView(body) {
+    if (typeof body !== "string" || body === "")
+        return void 0;
+    let params;
+    try {
+        params = new URLSearchParams(body);
+    }
+    catch {
+        return void 0;
+    }
+    if (params.toString() !== body)
+        return void 0;
+    const view = /* @__PURE__ */ Object.create(null);
+    for (const [name, value] of params) {
+        if (!Object.prototype.hasOwnProperty.call(view, name))
+            view[name] = value;
+        else
+            view[name] = Array.isArray(view[name]) ? [...view[name], value] : [view[name], value];
+    }
+    return view;
+}
+function readProfileBody(p, body) {
+    if (p.encoding === "form") {
+        const view = formBodyView(body);
+        return view === void 0 ? { refusal: "the paused body is not a form written the way a browser writes it, so its rules cannot be read" } : { parsed: view };
+    }
     let parsed;
     try {
         parsed = typeof body === "string" ? JSON.parse(body) : void 0;
     }
     catch {
-        return "the paused body is not JSON";
+        return { refusal: "the paused body is not JSON" };
     }
     if (!isPlainObject(parsed))
-        return "the paused body is not a JSON object";
+        return { refusal: "the paused body is not a JSON object" };
     if (!roundTrips(parsed, body))
-        return "the paused body does not round-trip through JSON, so its rules cannot be read";
+        return { refusal: "the paused body does not round-trip through JSON, so its rules cannot be read" };
+    return { parsed };
+}
+function merchantProfileBody(profile, body) {
+    const p = merchantProfileRecognizerById(typeof profile === "string" ? profile : profile?.id);
+    if (!p)
+        throw new Error("Refusing to pay: unknown merchant profile.");
+    return readProfileBody(p, body).parsed;
+}
+function merchantBodyRefusal(profile, body) {
+    const p = merchantProfileRecognizerById(typeof profile === "string" ? profile : profile?.id);
+    if (!p)
+        throw new Error("Refusing to pay: unknown merchant profile.");
+    const read = readProfileBody(p, body);
+    if (read.refusal)
+        return read.refusal;
+    const parsed = read.parsed;
+    const unreadText = textRefusal(p, parsed);
+    if (unreadText)
+        return unreadText;
     for (const rule of p.requires) {
-        const at = jsonAt(parsed, rule.path);
+        const at = profileAt(parsed, rule.path);
         if (!at.found || at.value !== rule.equals || valuesIgnoringCase(parsed, rule.path).some((value) => value !== rule.equals)) {
             return `the paused body is not ${p.merchant}'s card request: ${describePath(rule.path)} is not ${JSON.stringify(rule.equals)}`;
         }
@@ -1949,7 +2370,7 @@ var PASS = /* @__PURE__ */ Object.freeze({ verdict: "pass" });
 var PAUSE = /* @__PURE__ */ Object.freeze({ verdict: "pause" });
 var abort = (reason) => Object.freeze({ verdict: "abort", reason });
 function holderRefusal(profile, parsed) {
-    const holder = jsonAt(parsed, profile.holder);
+    const holder = profileAt(parsed, profile.holder);
     if (!holder.found || !isPlainObject(holder.value)) {
         return `the paused body carries no card object where ${profile.merchant}'s card request holds it`;
     }
@@ -1967,6 +2388,8 @@ function holderRefusal(profile, parsed) {
 function amountRefusal(profile, parsed) {
     const priced = isPlainObject(profile.amountSource);
     if (profile.amount === null || profile.amount === void 0) {
+        if (!priced && typeof profile.amountPending === "string" && profile.amountPending !== "")
+            return null;
         return priced ? null : `${profile.merchant}'s card request names no amount, so it cannot be checked against the amount the cardholder approves`;
     }
     if (!Array.isArray(profile.amount)) {
@@ -1984,7 +2407,7 @@ function amountRefusal(profile, parsed) {
         }
         return `the amount where ${profile.merchant}'s card request holds it is not the amount Agentcard reviewed, so it cannot be checked`;
     }
-    const at = jsonAt(parsed, profile.amount);
+    const at = profileAt(parsed, profile.amount);
     if (!at.found) {
         return priced ? null : `the paused body names no amount where ${profile.merchant}'s card request holds it, so it cannot be checked against the amount the cardholder approves`;
     }
@@ -2002,7 +2425,7 @@ function classifyMerchantBody(profileId, body) {
     const refusal = merchantBodyRefusal(profile.id, body);
     if (refusal)
         return abort(refusal);
-    const parsed = JSON.parse(body);
+    const parsed = merchantProfileBody(profile.id, body);
     const card = holderRefusal(profile, parsed) ?? amountRefusal(profile, parsed);
     return card ? abort(card) : PAUSE;
 }
@@ -2098,7 +2521,22 @@ function merchantBodyKeyPathSha256(body) {
         parsed = JSON.parse(body);
     }
     catch {
-        return null;
+        parsed = void 0;
+    }
+    if (parsed === void 0) {
+        const view = formBodyView(body);
+        if (view === void 0)
+            return null;
+        parsed = Object.fromEntries(Object.entries(view).map(([name, value]) => {
+            if (typeof value !== "string" || !/^[[{]/.test(value))
+                return [name, value];
+            try {
+                return [name, JSON.parse(value)];
+            }
+            catch {
+                return [name, value];
+            }
+        }));
     }
     const paths = /* @__PURE__ */ new Set();
     keyPaths(parsed, paths);

package/dist/agent-amount.generated.js

@@ -1,3 +1,3 @@
 // Written by scripts/generate-agent-amount.mjs from agent-amount-processors.json. Do not edit; git ignores it.
 /** agent-amount-processors.json, sorted; client.ts reads its amount tables from it. */
-export const AGENT_AMOUNT = { "processors": ["amazon_payment_services", "barion", "clover", "comgate", "cybersource_secure_acceptance", "fastspring", "gmo_pg", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "nexi_checkout", "omise", "openpay_bbva", "paddle_vgs", "pay_nl", "payfast", "paygent", "paymongo", "paypal", "payrexx", "paytrail", "payu_latam", "pelecard", "pin_payments", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p", "wix_payments", "wspay"], "aboveZero": ["amazon_payment_services", "barion", "clover", "comgate", "fastspring", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "nexi_checkout", "omise", "openpay_bbva", "pay_nl", "payfast", "paymongo", "paypal", "payrexx", "payu_latam", "pin_payments", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p"], "pageAmount": ["pelecard", "sb_payment_service"], "names": { "amazon_payment_services": "Amazon Payment Services", "barion": "Barion", "clover": "Clover", "comgate": "ComGate", "cybersource_secure_acceptance": "CyberSource Secure Acceptance", "fastspring": "FastSpring", "gmo_pg": "GMO", "gopay": "GoPay", "hipay": "HiPay", "makecommerce": "MakeCommerce", "midtrans": "Midtrans", "moneris": "Moneris", "nexi_checkout": "Nexi Checkout", "omise": "Omise", "openpay_bbva": "Openpay", "paddle_vgs": "Paddle", "pay_nl": "Pay.", "payfast": "Payfast", "paygent": "Paygent", "paymongo": "PayMongo", "paypal": "PayPal", "payrexx": "Payrexx", "paytrail": "Paytrail", "payu_latam": "PayU Latam", "pelecard": "Pelecard", "pin_payments": "Pin Payments", "poynt": "GoDaddy Payments", "przelewy24": "Przelewy24", "revolut": "Revolut", "sb_payment_service": "SB Payment Service", "sumup": "SumUp", "tap_payments": "Tap", "toast": "Toast", "tokenex_iframe": "TokenEx", "transbank_webpay": "Webpay", "twoc2p": "2C2P", "wix_payments": "Wix", "wspay": "WSPay" } };
+export const AGENT_AMOUNT = { "processors": ["amazon_payment_services", "barion", "bluesnap", "clover", "comgate", "cybersource_secure_acceptance", "fastspring", "gmo_pg", "gopay", "hipay", "iyzico", "makecommerce", "midtrans", "moneris", "nexi_checkout", "oceanpayment", "omise", "openpay_bbva", "paddle_vgs", "pay_nl", "payfast", "paygent", "paymentwall", "paymongo", "paypal", "payplug", "payrexx", "paytrail", "payu_latam", "pelecard", "pin_payments", "poynt", "processout", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p", "usaepay", "wix_payments", "wspay"], "aboveZero": ["amazon_payment_services", "barion", "bluesnap", "clover", "comgate", "fastspring", "gopay", "hipay", "iyzico", "makecommerce", "midtrans", "moneris", "nexi_checkout", "oceanpayment", "omise", "openpay_bbva", "pay_nl", "payfast", "paymentwall", "paymongo", "paypal", "payplug", "payrexx", "payu_latam", "pin_payments", "poynt", "processout", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p", "usaepay"], "pageAmount": ["pelecard", "sb_payment_service"], "names": { "amazon_payment_services": "Amazon Payment Services", "barion": "Barion", "bluesnap": "BlueSnap", "clover": "Clover", "comgate": "ComGate", "cybersource_secure_acceptance": "CyberSource Secure Acceptance", "fastspring": "FastSpring", "gmo_pg": "GMO", "gopay": "GoPay", "hipay": "HiPay", "iyzico": "iyzico", "makecommerce": "MakeCommerce", "midtrans": "Midtrans", "moneris": "Moneris", "nexi_checkout": "Nexi Checkout", "oceanpayment": "Oceanpayment", "omise": "Omise", "openpay_bbva": "Openpay", "paddle_vgs": "Paddle", "pay_nl": "Pay.", "payfast": "Payfast", "paygent": "Paygent", "paymentwall": "Paymentwall", "paymongo": "PayMongo", "paypal": "PayPal", "payplug": "PayPlug", "payrexx": "Payrexx", "paytrail": "Paytrail", "payu_latam": "PayU Latam", "pelecard": "Pelecard", "pin_payments": "Pin Payments", "poynt": "GoDaddy Payments", "processout": "ProcessOut", "przelewy24": "Przelewy24", "revolut": "Revolut", "sb_payment_service": "SB Payment Service", "sumup": "SumUp", "tap_payments": "Tap", "toast": "Toast", "tokenex_iframe": "TokenEx", "transbank_webpay": "Webpay", "twoc2p": "2C2P", "usaepay": "USAePay", "wix_payments": "Wix", "wspay": "WSPay" } };

package/dist/agentcard.d.ts

@@ -1,10 +1,9 @@
 /**
- * The one client: `new Agentcard({ clientId, clientSecret, voice?, sandbox? })`,
+ * The one client: `new Agentcard({ clientId, clientSecret, sandbox? })`,
  * with two modules. `checkout` pauses a browser purchase or creates one
- * directly and replays the processor's answer; `voice` connects a person to
- * your product once and approves a purchase by voice. One pair of
- * credentials, one token, one base URL; sandbox and live are decided by the
- * credentials.
+ * directly and replays the processor's answer; `buy` asks the Purchase API
+ * for a cart and places it. One pair of credentials, one token, one base
+ * URL; sandbox and live are decided by the credentials.
  */
 import { VaultClient, type AuthorizeInput, type PrepareCheckoutInput, type PreparedCheckout, type ReplayResponse, type RuntimeCancelReason, type VaultClientOptions } from './client.js';
 import { type AttachOptions, type CdpLike } from './cdp.js';