@agent-cards/sdk 0.23.28 → 0.24.1

package/dist/shiji-sts.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 9e15c873e3e3002651f0d5bcde91507c344bf33bfacec748aabfd56c6e7529f1
+// artifact-sha256: a8df2fb26245ce80114ca67b02b7b6b0319e93217035e4fb52ea77c640e42189
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,
@@ -146,6 +146,7 @@ var BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
 var SHA256_HEX = /^[0-9a-f]{64}$/;
 var RSA_ALGORITHM = [48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0];
 var MODULUS_BYTES = [128, 256, 384, 512];
+var SMALL_MODULUS_BYTES = 64;
 var MIN_PADDING = 8;
 var MAX_DRAWS = 16;
 var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
@@ -156,6 +157,9 @@ function parseRsaPublicKey(key) {
     const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
     if (named !== void 0 && named !== 17)
         throw refuse("key");
+    const sized = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "bits") ? key.bits : void 0;
+    if (sized !== void 0 && sized !== 512)
+        throw refuse("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse("key");
     if (typeof pin !== "string" || !SHA256_HEX.test(pin))
@@ -188,7 +192,8 @@ function parseRsaPublicKey(key) {
     if (exponent.end !== rsa.end)
         throw refuse("key");
     const n = modulus.bytes;
-    if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
+    const sizes = sized === 512 ? [SMALL_MODULUS_BYTES] : MODULUS_BYTES;
+    if (!sizes.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
         throw refuse("key");
     const e = exponent.bytes;
     const expected = named === 17 ? [17] : [1, 0, 1];
@@ -335,9 +340,64 @@ function isPlainObject(v) {
     return !!v && typeof v === "object" && !Array.isArray(v);
 }
 var MAX_PATH_STEPS = 16;
+var MAX_TEXT_STEPS = 2;
+function isTextStep(step) {
+    return isPlainObject(step) && Object.keys(step).length === 1 && step.text === "json";
+}
+function sameStep(a, b) {
+    return a === b || isTextStep(a) && isTextStep(b);
+}
+function spellJson(parsed, form) {
+    const text = JSON.stringify(parsed);
+    if (form !== "php")
+        return text;
+    return text.replace(/\//g, "\\/").replace(/[\u0080-\uffff]/g, (unit) => `\\u${unit.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function jsonTextForm(value) {
+    if (typeof value !== "string" || !/^[[{]/.test(value))
+        return void 0;
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        return void 0;
+    }
+    if (parsed === null || typeof parsed !== "object")
+        return void 0;
+    for (const form of ["js", "php"]) {
+        try {
+            if (spellJson(parsed, form) === value)
+                return { parsed, form };
+        }
+        catch {
+            return void 0;
+        }
+    }
+    return void 0;
+}
+function jsonText(value) {
+    return jsonTextForm(value)?.parsed;
+}
 function isJsonPath(path) {
     return Array.isArray(path) && path.length <= MAX_PATH_STEPS && path.every((step) => typeof step === "string" ? step.length > 0 && !FORBIDDEN_KEYS.has(step) : Number.isSafeInteger(step) && step >= 0);
 }
+function isProfilePath(path) {
+    if (!Array.isArray(path) || path.length > MAX_PATH_STEPS)
+        return false;
+    let texts = 0;
+    for (const [i, step] of path.entries()) {
+        if (isTextStep(step)) {
+            texts += 1;
+            if (i === 0 || i === path.length - 1 || isTextStep(path[i - 1]) || texts > MAX_TEXT_STEPS)
+                return false;
+        }
+        else if (!isJsonPath([step])) {
+            return false;
+        }
+    }
+    return true;
+}
 function jsonAt(root, path) {
     let node = root;
     for (const step of path) {
@@ -352,6 +412,42 @@ function jsonAt(root, path) {
     }
     return { found: true, value: node };
 }
+function profileAt(root, path) {
+    if (!isProfilePath(path))
+        return { found: false };
+    let node = root;
+    for (const step of path) {
+        if (isTextStep(step)) {
+            const inner = jsonText(node);
+            if (inner === void 0)
+                return { found: false };
+            node = inner;
+            continue;
+        }
+        const at = jsonAt(node, [step]);
+        if (!at.found)
+            return { found: false };
+        node = at.value;
+    }
+    return { found: true, value: node };
+}
+function editAtProfilePath(root, path, edit) {
+    const at = profileAt(root, path);
+    if (!at.found || !isPlainObject(at.value))
+        return false;
+    const k = path.findIndex(isTextStep);
+    if (k === -1) {
+        edit(at.value);
+        return true;
+    }
+    const holder = jsonAt(root, path.slice(0, k - 1)).value;
+    const key = path[k - 1];
+    const text = jsonTextForm(holder[key]);
+    if (!text || !editAtProfilePath(text.parsed, path.slice(k + 1), edit))
+        return false;
+    holder[key] = spellJson(text.parsed, text.form);
+    return true;
+}
 function roundTrips(parsed, body) {
     try {
         return JSON.stringify(parsed) === body;
@@ -361,17 +457,17 @@ function roundTrips(parsed, body) {
     }
 }
 function sameSteps(a, b) {
-    return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((step, i) => step === b[i]);
+    return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((step, i) => sameStep(step, b[i]));
 }
 function pathsOverlap(a, b) {
     const n = Math.min(a.length, b.length);
     for (let i = 0; i < n; i += 1)
-        if (a[i] !== b[i])
+        if (!sameStep(a[i], b[i]))
             return false;
     return true;
 }
 function describePath(path) {
-    return path.length ? path.map((step) => typeof step === "number" ? `[${step}]` : `.${step}`).join("").replace(/^\./, "") : "(root)";
+    return path.length ? path.map((step) => typeof step === "number" ? `[${step}]` : isTextStep(step) ? "<json>" : `.${step}`).join("").replace(/^\./, "") : "(root)";
 }
 // src/substitution-primitives.js
 var SubstitutionError = class extends Error {
@@ -420,7 +516,7 @@ function swapMerchantHostedFields(body, spec, ciphertext = ADYEN_JWE) {
     const path = Array.isArray(spec.path) ? [...spec.path] : spec.path;
     const fields = isPlainObject(spec.fields) ? Object.fromEntries(Object.entries(spec.fields)) : null;
     const remove = Array.isArray(spec.remove) ? [...spec.remove] : spec.remove ?? [];
-    if (!isJsonPath(path))
+    if (!isProfilePath(path))
         throw new SubstitutionError("refusing substitution path");
     if (!fields || Object.keys(fields).length === 0)
         throw new SubstitutionError("substitutions carry no fields");
@@ -454,7 +550,7 @@ function swapMerchantHostedFields(body, spec, ciphertext = ADYEN_JWE) {
     }
     if (!isPlainObject(parsed))
         throw new SubstitutionError("the paused body is not a JSON object");
-    const holder = jsonAt(parsed, path);
+    const holder = profileAt(parsed, path);
     if (!holder.found || !isPlainObject(holder.value))
         throw new SubstitutionError(`the paused body has no object at ${describePath(path)}`);
     const swaps = /* @__PURE__ */ new Map();
@@ -506,15 +602,19 @@ function swapMerchantHostedFields(body, spec, ciphertext = ADYEN_JWE) {
     catch {
         throw new SubstitutionError("the substituted body is not JSON");
     }
-    const written = jsonAt(out, path);
+    const written = profileAt(out, path);
     if (!written.found || !isPlainObject(written.value) || names.some((name) => written.value[name] !== fields[name]) || dummies.some((dummy) => swapped.includes(dummy))) {
         throw new SubstitutionError(`the substitution did not land at ${describePath(path)}`);
     }
     if (remove.length === 0 && set.length === 0)
         return swapped;
-    for (const key of remove)
-        if (Object.prototype.hasOwnProperty.call(written.value, key))
-            delete written.value[key];
+    if (remove.length > 0 && !editAtProfilePath(out, path, (object) => {
+        for (const key of remove)
+            if (Object.prototype.hasOwnProperty.call(object, key))
+                delete object[key];
+    })) {
+        throw new SubstitutionError(`the substitution did not land at ${describePath(path)}`);
+    }
     for (const entry of set) {
         const parent = jsonAt(out, entry.path.slice(0, -1));
         if (!parent.found || !isPlainObject(parent.value))