@agent-cards/sdk 0.23.28 → 0.24.1

package/dist/oceanpayment.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Oceanpayment's hosted payment page (secure.oceanpayment.com, and test-secure.oceanpayment.com, its sandbox), as this SDK
+ * reads it.
+ *
+ * The page, where Oceanpayment's Shopify redirect app sends the buyer after Shopify's Pay now, submits its card form as one
+ * form post to /gateway/sendPay;jsessionid=<the payment's session>, the card in clear. That post is the one request this
+ * SDK pauses: the cardholder's device writes the real card into it and sends it through the checkout relay (payment-core
+ * processors/oceanpayment.js). The page's other posts to these hosts lead to or carry the card the agent typed: Cardinal's
+ * device-data call (/gateway/CreateJWTInterface) posts the whole number when the merchant's terminal turns it on, and a card
+ * post written another way would carry it to Oceanpayment as a payment. This SDK aborts every one of them in a page it
+ * watches, so the agent's placeholder never reaches Oceanpayment. A GET (the page, its scripts, its log) continues.
+ *
+ * OCEANPAYMENT_HOSTS is payment-core's OCEANPAYMENT_HOSTS, and isOceanpaymentSendPay takes the URLs payment-core's
+ * isOceanpaymentSendPayUrl takes; oceanpayment.test.mjs pins both to payment-core.
+ */
+export declare const OCEANPAYMENT_PSP = "oceanpayment";
+/** The dark-launch capability the API serves Oceanpayment's recognizer behind (payment-core processors/oceanpayment.js). */
+export declare const OCEANPAYMENT_CAPABILITY = "oceanpayment_hosted_payment_page";
+/** The live host and Oceanpayment's sandbox, which serves the same page for a test terminal. */
+export declare const OCEANPAYMENT_HOSTS: readonly string[];
+/** Whether this URL is on one of Oceanpayment's two hosts. */
+export declare function isOceanpaymentHost(url: string): boolean;
+/**
+ * The only request on Oceanpayment's hosts that is the page's card post: a POST to exactly
+ * https://<host>/gateway/sendPay;jsessionid=<session>, as the page's form action writes it, with no port, query, fragment
+ * or other spelling (payment-core isOceanpaymentSendPayUrl takes the same strings). The post the SDK pauses.
+ */
+export declare function isOceanpaymentSendPay(url: string, method: string): boolean;
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on an Oceanpayment host and this build's
+ * registry serves Oceanpayment's card post there. Cardinal's call and a card post of another spelling are not the card
+ * post, so the registry's card-request test does not name them; the CDP adapter still pauses them through the
+ * recognizer's host pattern, and attachToPlaywright's route predicate asks this, so both adapters show the gates every
+ * request to Oceanpayment once Oceanpayment is armed.
+ */
+export declare function isArmedOceanpaymentUrl(vault: {
+    isCardRequest(url: string, method?: string): boolean;
+}, url: string): boolean;

package/dist/oceanpayment.js

@@ -0,0 +1,70 @@
+/**
+ * Oceanpayment's hosted payment page (secure.oceanpayment.com, and test-secure.oceanpayment.com, its sandbox), as this SDK
+ * reads it.
+ *
+ * The page, where Oceanpayment's Shopify redirect app sends the buyer after Shopify's Pay now, submits its card form as one
+ * form post to /gateway/sendPay;jsessionid=<the payment's session>, the card in clear. That post is the one request this
+ * SDK pauses: the cardholder's device writes the real card into it and sends it through the checkout relay (payment-core
+ * processors/oceanpayment.js). The page's other posts to these hosts lead to or carry the card the agent typed: Cardinal's
+ * device-data call (/gateway/CreateJWTInterface) posts the whole number when the merchant's terminal turns it on, and a card
+ * post written another way would carry it to Oceanpayment as a payment. This SDK aborts every one of them in a page it
+ * watches, so the agent's placeholder never reaches Oceanpayment. A GET (the page, its scripts, its log) continues.
+ *
+ * OCEANPAYMENT_HOSTS is payment-core's OCEANPAYMENT_HOSTS, and isOceanpaymentSendPay takes the URLs payment-core's
+ * isOceanpaymentSendPayUrl takes; oceanpayment.test.mjs pins both to payment-core.
+ */
+export const OCEANPAYMENT_PSP = 'oceanpayment';
+/** The dark-launch capability the API serves Oceanpayment's recognizer behind (payment-core processors/oceanpayment.js). */
+export const OCEANPAYMENT_CAPABILITY = 'oceanpayment_hosted_payment_page';
+/** The live host and Oceanpayment's sandbox, which serves the same page for a test terminal. */
+export const OCEANPAYMENT_HOSTS = Object.freeze(['secure.oceanpayment.com', 'test-secure.oceanpayment.com']);
+const SEND_PAY = /^\/gateway\/sendPay;jsessionid=[A-Za-z0-9._!-]{16,128}$/;
+// A session in the shape the recognizer takes, to ask whether this build's registry serves the card post on a host.
+const PROBE_SESSION = 'ARMEDPROBESESSION0';
+/** The Oceanpayment host a URL is on (https, no credentials, any port, any letter case, a trailing dot or not), or null. */
+function oceanpaymentHost(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== 'https:' || url.username || url.password)
+        return null;
+    const host = url.hostname.toLowerCase().replace(/\.$/, '');
+    return OCEANPAYMENT_HOSTS.includes(host) ? host : null;
+}
+/** Whether this URL is on one of Oceanpayment's two hosts. */
+export function isOceanpaymentHost(url) {
+    return oceanpaymentHost(url) !== null;
+}
+/**
+ * The only request on Oceanpayment's hosts that is the page's card post: a POST to exactly
+ * https://<host>/gateway/sendPay;jsessionid=<session>, as the page's form action writes it, with no port, query, fragment
+ * or other spelling (payment-core isOceanpaymentSendPayUrl takes the same strings). The post the SDK pauses.
+ */
+export function isOceanpaymentSendPay(url, method) {
+    if (String(method).toUpperCase() !== 'POST' || typeof url !== 'string' || url.includes('?') || url.includes('#'))
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    return parsed.href === url && parsed.protocol === 'https:' && !parsed.port && !parsed.username && !parsed.password
+        && OCEANPAYMENT_HOSTS.includes(parsed.hostname) && SEND_PAY.test(parsed.pathname);
+}
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on an Oceanpayment host and this build's
+ * registry serves Oceanpayment's card post there. Cardinal's call and a card post of another spelling are not the card
+ * post, so the registry's card-request test does not name them; the CDP adapter still pauses them through the
+ * recognizer's host pattern, and attachToPlaywright's route predicate asks this, so both adapters show the gates every
+ * request to Oceanpayment once Oceanpayment is armed.
+ */
+export function isArmedOceanpaymentUrl(vault, url) {
+    const host = oceanpaymentHost(url);
+    return host !== null && vault.isCardRequest(`https://${host}/gateway/sendPay;jsessionid=${PROBE_SESSION}`, 'POST');
+}

package/dist/paddle-tokenex.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: cb62940ac92ca9f2a61b5168f362003d67998f12d045b18d8bd07ae352e0cb3e
+// artifact-sha256: 0bd60e76821ed0f63235a99cc37dece9f0db8afef89492a0a7930fb49f80eb18
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,
@@ -146,6 +146,7 @@ var BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
 var SHA256_HEX = /^[0-9a-f]{64}$/;
 var RSA_ALGORITHM = [48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0];
 var MODULUS_BYTES = [128, 256, 384, 512];
+var SMALL_MODULUS_BYTES = 64;
 var MIN_PADDING = 8;
 var MAX_DRAWS = 16;
 var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
@@ -156,6 +157,9 @@ function parseRsaPublicKey(key) {
     const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
     if (named !== void 0 && named !== 17)
         throw refuse("key");
+    const sized = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "bits") ? key.bits : void 0;
+    if (sized !== void 0 && sized !== 512)
+        throw refuse("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse("key");
     if (typeof pin2 !== "string" || !SHA256_HEX.test(pin2))
@@ -188,7 +192,8 @@ function parseRsaPublicKey(key) {
     if (exponent.end !== rsa.end)
         throw refuse("key");
     const n = modulus.bytes;
-    if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
+    const sizes = sized === 512 ? [SMALL_MODULUS_BYTES] : MODULUS_BYTES;
+    if (!sizes.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
         throw refuse("key");
     const e = exponent.bytes;
     const expected = named === 17 ? [17] : [1, 0, 1];
@@ -429,9 +434,64 @@ function isPlainObject(v) {
     return !!v && typeof v === "object" && !Array.isArray(v);
 }
 var MAX_PATH_STEPS = 16;
+var MAX_TEXT_STEPS = 2;
+function isTextStep(step) {
+    return isPlainObject(step) && Object.keys(step).length === 1 && step.text === "json";
+}
+function sameStep(a, b) {
+    return a === b || isTextStep(a) && isTextStep(b);
+}
+function spellJson(parsed, form) {
+    const text = JSON.stringify(parsed);
+    if (form !== "php")
+        return text;
+    return text.replace(/\//g, "\\/").replace(/[\u0080-\uffff]/g, (unit) => `\\u${unit.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function jsonTextForm(value) {
+    if (typeof value !== "string" || !/^[[{]/.test(value))
+        return void 0;
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        return void 0;
+    }
+    if (parsed === null || typeof parsed !== "object")
+        return void 0;
+    for (const form of ["js", "php"]) {
+        try {
+            if (spellJson(parsed, form) === value)
+                return { parsed, form };
+        }
+        catch {
+            return void 0;
+        }
+    }
+    return void 0;
+}
+function jsonText(value) {
+    return jsonTextForm(value)?.parsed;
+}
 function isJsonPath(path) {
     return Array.isArray(path) && path.length <= MAX_PATH_STEPS && path.every((step) => typeof step === "string" ? step.length > 0 && !FORBIDDEN_KEYS.has(step) : Number.isSafeInteger(step) && step >= 0);
 }
+function isProfilePath(path) {
+    if (!Array.isArray(path) || path.length > MAX_PATH_STEPS)
+        return false;
+    let texts = 0;
+    for (const [i, step] of path.entries()) {
+        if (isTextStep(step)) {
+            texts += 1;
+            if (i === 0 || i === path.length - 1 || isTextStep(path[i - 1]) || texts > MAX_TEXT_STEPS)
+                return false;
+        }
+        else if (!isJsonPath([step])) {
+            return false;
+        }
+    }
+    return true;
+}
 function jsonAt(root, path) {
     let node = root;
     for (const step of path) {
@@ -446,6 +506,42 @@ function jsonAt(root, path) {
     }
     return { found: true, value: node };
 }
+function profileAt(root, path) {
+    if (!isProfilePath(path))
+        return { found: false };
+    let node = root;
+    for (const step of path) {
+        if (isTextStep(step)) {
+            const inner = jsonText(node);
+            if (inner === void 0)
+                return { found: false };
+            node = inner;
+            continue;
+        }
+        const at = jsonAt(node, [step]);
+        if (!at.found)
+            return { found: false };
+        node = at.value;
+    }
+    return { found: true, value: node };
+}
+function editAtProfilePath(root, path, edit) {
+    const at = profileAt(root, path);
+    if (!at.found || !isPlainObject(at.value))
+        return false;
+    const k = path.findIndex(isTextStep);
+    if (k === -1) {
+        edit(at.value);
+        return true;
+    }
+    const holder = jsonAt(root, path.slice(0, k - 1)).value;
+    const key = path[k - 1];
+    const text = jsonTextForm(holder[key]);
+    if (!text || !editAtProfilePath(text.parsed, path.slice(k + 1), edit))
+        return false;
+    holder[key] = spellJson(text.parsed, text.form);
+    return true;
+}
 function roundTrips(parsed, body) {
     try {
         return JSON.stringify(parsed) === body;
@@ -455,17 +551,17 @@ function roundTrips(parsed, body) {
     }
 }
 function sameSteps(a, b) {
-    return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((step, i) => step === b[i]);
+    return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((step, i) => sameStep(step, b[i]));
 }
 function pathsOverlap(a, b) {
     const n = Math.min(a.length, b.length);
     for (let i = 0; i < n; i += 1)
-        if (a[i] !== b[i])
+        if (!sameStep(a[i], b[i]))
             return false;
     return true;
 }
 function describePath(path) {
-    return path.length ? path.map((step) => typeof step === "number" ? `[${step}]` : `.${step}`).join("").replace(/^\./, "") : "(root)";
+    return path.length ? path.map((step) => typeof step === "number" ? `[${step}]` : isTextStep(step) ? "<json>" : `.${step}`).join("").replace(/^\./, "") : "(root)";
 }
 // src/substitution-primitives.js
 var SubstitutionError = class extends Error {
@@ -514,7 +610,7 @@ function swapMerchantHostedFields(body, spec, ciphertext = ADYEN_JWE) {
     const path = Array.isArray(spec.path) ? [...spec.path] : spec.path;
     const fields = isPlainObject(spec.fields) ? Object.fromEntries(Object.entries(spec.fields)) : null;
     const remove = Array.isArray(spec.remove) ? [...spec.remove] : spec.remove ?? [];
-    if (!isJsonPath(path))
+    if (!isProfilePath(path))
         throw new SubstitutionError("refusing substitution path");
     if (!fields || Object.keys(fields).length === 0)
         throw new SubstitutionError("substitutions carry no fields");
@@ -548,7 +644,7 @@ function swapMerchantHostedFields(body, spec, ciphertext = ADYEN_JWE) {
     }
     if (!isPlainObject(parsed))
         throw new SubstitutionError("the paused body is not a JSON object");
-    const holder = jsonAt(parsed, path);
+    const holder = profileAt(parsed, path);
     if (!holder.found || !isPlainObject(holder.value))
         throw new SubstitutionError(`the paused body has no object at ${describePath(path)}`);
     const swaps = /* @__PURE__ */ new Map();
@@ -600,15 +696,19 @@ function swapMerchantHostedFields(body, spec, ciphertext = ADYEN_JWE) {
     catch {
         throw new SubstitutionError("the substituted body is not JSON");
     }
-    const written = jsonAt(out, path);
+    const written = profileAt(out, path);
     if (!written.found || !isPlainObject(written.value) || names.some((name) => written.value[name] !== fields[name]) || dummies.some((dummy) => swapped.includes(dummy))) {
         throw new SubstitutionError(`the substitution did not land at ${describePath(path)}`);
     }
     if (remove.length === 0 && set.length === 0)
         return swapped;
-    for (const key of remove)
-        if (Object.prototype.hasOwnProperty.call(written.value, key))
-            delete written.value[key];
+    if (remove.length > 0 && !editAtProfilePath(out, path, (object) => {
+        for (const key of remove)
+            if (Object.prototype.hasOwnProperty.call(object, key))
+                delete object[key];
+    })) {
+        throw new SubstitutionError(`the substitution did not land at ${describePath(path)}`);
+    }
     for (const entry of set) {
         const parent = jsonAt(out, entry.path.slice(0, -1));
         if (!parent.found || !isPlainObject(parent.value))

package/dist/payplug.d.ts

@@ -0,0 +1,41 @@
+/**
+ * PayPlug's hosted payment page (secure.payplug.com, where French merchants send a buyer who pays by card), as this SDK
+ * reads it.
+ *
+ * The merchant's server creates the payment with PayPlug and sends the buyer's browser to the page's URL PayPlug answered
+ * with, https://secure.payplug.com/pay/<payment id>, or /pay/test/<payment id> for a test payment, by a redirect or by
+ * setting the page's location. PayPlug's Shopify app does the same from Shopify's checkout. That GET carries no card, no
+ * amount and no merchant, and it is the one request a build that declares PayPlug's capability pauses (hosted-entry.ts):
+ * the cardholder's device repeats it over the end-to-end TLS relay and pays on the page PayPlug returns to it (payment-core
+ * processors/payplug.js). Every step toward paying on that page is a POST to PayPlug's host, the page's card post among
+ * them, with the card encrypted under the page's own key.
+ *
+ * PAYPLUG_HOST is payment-core's PAYPLUG_HOST, and isPayplugEntryUrl is payment-core's isPayplugEntryUrl; payplug.test.mjs
+ * pins both to payment-core on every case payment-core's own tests list.
+ */
+export declare const PAYPLUG_PSP = "payplug";
+/** The dark-launch capability the API serves PayPlug's recognizer behind (payment-core processors/payplug.js). */
+export declare const PAYPLUG_CAPABILITY = "payplug_hosted_payment_page";
+/** PayPlug's page host, which its test and live payments share; the entry's path says which one a payment is. */
+export declare const PAYPLUG_HOST = "secure.payplug.com";
+/**
+ * Whether a URL is the payment page's URL exactly as PayPlug writes payment_url: https, secure.payplug.com in lower case,
+ * the default port, no credentials, no query and no fragment, not even an empty one, and the path /pay/<id> or
+ * /pay/test/<id> with the payment's 22-character id. The lightbox's ?lightbox=1, or any other query, asks PayPlug's page
+ * for something else, so it is not the entry, and neither is any other request to PayPlug's host.
+ */
+export declare function isPayplugEntryUrl(raw: unknown): boolean;
+/**
+ * Whether a request on PayPlug's page host is a step toward paying there: any POST, the page's card post and its
+ * 3-D Secure posts among them. The page itself, its scripts, its images and its frames are GETs of no card and are not one.
+ */
+export declare function isPayplugPayStep(url: string, method: string): boolean;
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on PayPlug's page host and this build's
+ * registry serves PayPlug's entry. The page's posts are not the entry, so the registry's card-request test does not name
+ * them; the CDP adapter still pauses them through the recognizer's host pattern, and attachToPlaywright's route predicate
+ * asks this, so both adapters show the gates every request to the page's host once PayPlug is armed.
+ */
+export declare function isArmedPayplugUrl(vault: {
+    isCardRequest(url: string, method?: string): boolean;
+} | undefined, url: string): boolean;

package/dist/payplug.js

@@ -0,0 +1,71 @@
+/**
+ * PayPlug's hosted payment page (secure.payplug.com, where French merchants send a buyer who pays by card), as this SDK
+ * reads it.
+ *
+ * The merchant's server creates the payment with PayPlug and sends the buyer's browser to the page's URL PayPlug answered
+ * with, https://secure.payplug.com/pay/<payment id>, or /pay/test/<payment id> for a test payment, by a redirect or by
+ * setting the page's location. PayPlug's Shopify app does the same from Shopify's checkout. That GET carries no card, no
+ * amount and no merchant, and it is the one request a build that declares PayPlug's capability pauses (hosted-entry.ts):
+ * the cardholder's device repeats it over the end-to-end TLS relay and pays on the page PayPlug returns to it (payment-core
+ * processors/payplug.js). Every step toward paying on that page is a POST to PayPlug's host, the page's card post among
+ * them, with the card encrypted under the page's own key.
+ *
+ * PAYPLUG_HOST is payment-core's PAYPLUG_HOST, and isPayplugEntryUrl is payment-core's isPayplugEntryUrl; payplug.test.mjs
+ * pins both to payment-core on every case payment-core's own tests list.
+ */
+export const PAYPLUG_PSP = 'payplug';
+/** The dark-launch capability the API serves PayPlug's recognizer behind (payment-core processors/payplug.js). */
+export const PAYPLUG_CAPABILITY = 'payplug_hosted_payment_page';
+/** PayPlug's page host, which its test and live payments share; the entry's path says which one a payment is. */
+export const PAYPLUG_HOST = 'secure.payplug.com';
+// The entry's path: /pay/<id> for a live payment, /pay/test/<id> for a test one, the id as PayPlug writes it.
+const ENTRY_PATH = /^\/pay\/(?:test\/)?[A-Za-z0-9]{22}$/;
+// An id of that shape, for asking whether this build's registry serves the entry.
+const PROBE = 'https://secure.payplug.com/pay/0000000000000000000000';
+/**
+ * Whether a URL is the payment page's URL exactly as PayPlug writes payment_url: https, secure.payplug.com in lower case,
+ * the default port, no credentials, no query and no fragment, not even an empty one, and the path /pay/<id> or
+ * /pay/test/<id> with the payment's 22-character id. The lightbox's ?lightbox=1, or any other query, asks PayPlug's page
+ * for something else, so it is not the entry, and neither is any other request to PayPlug's host.
+ */
+export function isPayplugEntryUrl(raw) {
+    if (typeof raw !== 'string' || raw.length > 256 || raw.includes('?') || raw.includes('#'))
+        return false;
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    if (url.href !== raw || url.protocol !== 'https:' || url.hostname !== PAYPLUG_HOST || url.port || url.username || url.password)
+        return false;
+    return ENTRY_PATH.test(url.pathname);
+}
+/** Whether a URL is on PayPlug's page host: https, no credentials, any port, any letter case, a trailing dot or not. */
+function onPayplugHost(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    return url.protocol === 'https:' && !url.username && !url.password && url.hostname.toLowerCase().replace(/\.$/, '') === PAYPLUG_HOST;
+}
+/**
+ * Whether a request on PayPlug's page host is a step toward paying there: any POST, the page's card post and its
+ * 3-D Secure posts among them. The page itself, its scripts, its images and its frames are GETs of no card and are not one.
+ */
+export function isPayplugPayStep(url, method) {
+    return onPayplugHost(url) && String(method).toUpperCase() === 'POST';
+}
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on PayPlug's page host and this build's
+ * registry serves PayPlug's entry. The page's posts are not the entry, so the registry's card-request test does not name
+ * them; the CDP adapter still pauses them through the recognizer's host pattern, and attachToPlaywright's route predicate
+ * asks this, so both adapters show the gates every request to the page's host once PayPlug is armed.
+ */
+export function isArmedPayplugUrl(vault, url) {
+    return onPayplugHost(url) && typeof vault?.isCardRequest === 'function' && vault.isCardRequest(PROBE, 'GET');
+}

package/dist/payrails.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 056fa54de953be9af775505906b2fba30def2787a217a12fe2ca2a50b8614649
+// artifact-sha256: d6d50b6577a932c3586fcade6b8cbd03c562bd3394e8addcb954d797ea9999b4
 // src/json-path.js
 function roundTrips(parsed, body) {
     try {
@@ -10,6 +10,25 @@ function roundTrips(parsed, body) {
         return false;
     }
 }
+// src/answer-card-leak.js
+var DECIMAL = /\p{Nd}/u;
+function digitValue(char) {
+    const point = char.codePointAt(0);
+    let first = point;
+    while (DECIMAL.test(String.fromCodePoint(first - 1)))
+        first -= 1;
+    return String((point - first) % 10);
+}
+var ENCLOSED = /* @__PURE__ */ Object.freeze([[9451, 10, 11], [9461, 10, 1], [9471, 1, 0], [10102, 30, 1], [127243, 2, 0]]);
+var ENCLOSED_CHAR = /[\u24eb-\u24ff\u2776-\u2793\u{1f10b}\u{1f10c}]/gu;
+function enclosedValue(char) {
+    const point = char.codePointAt(0);
+    const [first, , start] = ENCLOSED.find(([from, size]) => point >= from && point < from + size);
+    return String(first === 127243 ? 0 : first === 10102 ? (point - first) % 10 + 1 : start + point - first);
+}
+var asciiDigits = (text) => (typeof text.normalize === "function" ? text.normalize("NFKC") : text).replace(ENCLOSED_CHAR, enclosedValue).replace(/\p{Nd}/gu, (char) => char >= "0" && char <= "9" ? char : digitValue(char));
+var digitCount = (text) => (asciiDigits(String(text)).match(/\p{N}/gu) ?? []).length;
+var NAME_DIGITS = 3;
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,
@@ -139,7 +158,7 @@ function sha256Hex(input) {
         H[6] += g;
         H[7] += h;
     }
-    return Array.from(H, (word) => word.toString(16).padStart(8, "0")).join("");
+    return Array.from(H, (word2) => word2.toString(16).padStart(8, "0")).join("");
 }
 // src/rsa-pkcs1v15.js
 var RsaPkcs1v15Error = class extends Error {
@@ -155,6 +174,7 @@ var BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
 var SHA256_HEX = /^[0-9a-f]{64}$/;
 var RSA_ALGORITHM = [48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0];
 var MODULUS_BYTES = [128, 256, 384, 512];
+var SMALL_MODULUS_BYTES = 64;
 var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
 var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStringTag).get;
 function parseRsaPublicKey(key) {
@@ -163,6 +183,9 @@ function parseRsaPublicKey(key) {
     const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
     if (named !== void 0 && named !== 17)
         throw refuse("key");
+    const sized = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "bits") ? key.bits : void 0;
+    if (sized !== void 0 && sized !== 512)
+        throw refuse("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse("key");
     if (typeof pin !== "string" || !SHA256_HEX.test(pin))
@@ -195,7 +218,8 @@ function parseRsaPublicKey(key) {
     if (exponent.end !== rsa.end)
         throw refuse("key");
     const n = modulus.bytes;
-    if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
+    const sizes = sized === 512 ? [SMALL_MODULUS_BYTES] : MODULUS_BYTES;
+    if (!sizes.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
         throw refuse("key");
     const e = exponent.bytes;
     const expected = named === 17 ? [17] : [1, 0, 1];
@@ -652,6 +676,7 @@ var PAYRAILS_SERVED_CARD_FACTS = Object.freeze(["bin", "binLookup", "holderName"
 var exact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
 var bin6 = (value) => exact(/^[0-9]{6,8}$/, value) ? value.slice(0, 6) : void 0;
 var label = (value, max) => plainText(value, max) ? value : void 0;
+var word = (value, max, digits = 0) => plainText(value, max) && digitCount(value) <= digits ? value : void 0;
 var pick = (value, pattern) => exact(pattern, value) ? value : void 0;
 var compact = (object) => Object.fromEntries(Object.entries(object).filter(([, value]) => value !== void 0));
 var nonEmpty = (object) => Object.keys(object).length ? object : void 0;
@@ -691,13 +716,13 @@ function sanitizePayrailsResponse(text) {
         bin: served.has("bin") ? bin6(data.bin) : void 0,
         binLookup: lookup ? nonEmpty(compact({
             bin: bin6(lookup.bin),
-            network: label(lookup.network, 32),
-            issuer: label(lookup.issuer, 128),
-            issuerCountry: country ? nonEmpty(compact({ code: pick(country.code, /^[A-Z]{2}$/), name: label(country.name, 64), iso3: pick(country.iso3, /^[A-Z]{3}$/) })) : void 0,
-            type: label(lookup.type, 32)
+            network: word(lookup.network, 32),
+            issuer: word(lookup.issuer, 128, NAME_DIGITS),
+            issuerCountry: country ? nonEmpty(compact({ code: pick(country.code, /^[A-Z]{2}$/), name: word(country.name, 64), iso3: pick(country.iso3, /^[A-Z]{3}$/) })) : void 0,
+            type: word(lookup.type, 32)
         })) : void 0,
         holderName: served.has("holderName") ? label(data.holderName, 200) : void 0,
-        network: served.has("network") ? label(data.network, 32) : void 0,
+        network: served.has("network") ? word(data.network, 32) : void 0,
         suffix: data.suffix,
         expiryMonth: served.has("expiryMonth") ? pick(data.expiryMonth, /^(?:0[1-9]|1[0-2])$/) : void 0,
         expiryYear: served.has("expiryYear") ? pick(data.expiryYear, /^(?:[0-9]{2}|[0-9]{4})$/) : void 0

package/dist/pre-claim.d.ts

@@ -12,6 +12,7 @@ import { type MerchantProfile } from './merchant-hosted.js';
 import type { MerchantHandoffWatch } from './merchant-handoff.js';
 import { type CybersourceFlexDecision, type CybersourceFlexPause, type FlexRequest } from './cybersource-flex.js';
 import { type CardEndpointProfile } from './card-endpoint.js';
+import { type NikeOrders } from './nike-order.js';
 import { type PayrailsSessionCapture, type PayrailsSidecar } from './payrails.js';
 import { type VerifoneProfile } from './verifone.js';
 import { type WorldlineMyCheckoutProducts } from './worldline-mycheckout.js';
@@ -250,6 +251,8 @@ export interface PreClaimContext {
      * card frame is refused.
      */
     payrexx?: PayrexxFollowUps;
+    /** The approval Nike's order is held to once a card went through Nike's profile (nike-order.ts). Absent: Nike's order is left alone. */
+    nikeOrders?: NikeOrders;
 }
 /**
  * The URL an event may name for a request. For an armed merchant profile's
@@ -265,6 +268,10 @@ export declare function eventUrl(vault: {
 /** A gate returns a decision when it handles the request, undefined to defer to
  * the next gate, or a promise of either when it must do I/O first. */
 export type PreClaimGate = (ctx: PreClaimContext) => PreClaimDecision | undefined | Promise<PreClaimDecision | undefined>;
+/** What the Nike order gate reads of a paused request and its attachment. */
+export type NikeOrderGateContext = Pick<PreClaimContext, 'request' | 'nikeOrders' | 'lifecycle' | 'effects' | 'onEvent' | 'lifecycleAborted' | 'terminal'>;
+/** The Nike order gate's decision, already performed, or undefined when the request is not its to judge. */
+export declare function nikeOrderGate(ctx: NikeOrderGateContext): Promise<PreClaimDecision> | undefined;
 export declare const MERCHANT_BODY_UNREADABLE = "the paused request carries no body the SDK could read, so Agentcard cannot tell whether it carries a card";
 export declare const verifonePreClaim: PreClaimGate;
 export declare const fiservPreClaim: PreClaimGate;
@@ -280,6 +287,9 @@ export declare function isArmedCreditguardCall(vault: {
 } | undefined, url: string): boolean;
 export declare const przelewy24PreClaim: PreClaimGate;
 export declare const barionPreClaim: PreClaimGate;
+export declare const payplugPreClaim: PreClaimGate;
+export declare const eghlPreClaim: PreClaimGate;
+export declare const cardlinkVposPreClaim: PreClaimGate;
 export declare const ekashuPreClaim: PreClaimGate;
 export declare const transbankPreClaim: PreClaimGate;
 export declare const paytrailPreClaim: PreClaimGate;
@@ -287,6 +297,7 @@ export declare const redsysPreClaim: PreClaimGate;
 export declare const quickpayPreClaim: PreClaimGate;
 export declare const comgatePreClaim: PreClaimGate;
 export declare const eximbayPreClaim: PreClaimGate;
+export declare const oceanpaymentPreClaim: PreClaimGate;
 export declare const paypalHostedFieldsPreClaim: PreClaimGate;
 export declare const paypalCardFormsPreClaim: PreClaimGate;
 export declare const cybersourceSecureAcceptancePreClaim: PreClaimGate;