@agent-cards/sdk 0.23.28 → 0.24.1

package/dist/substitutions.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: a1b7d280655947da8bb1d465d17c3436504ee350dd0be7f345d524eea0f2f374
+// artifact-sha256: f402656dc29200331356e78d920979d00a0768d87ea6c630e17c211455679d4b
 // src/adyen-jwe.js
 var ADYEN_JWE_HEADER = { alg: "RSA-OAEP-256", enc: "A256GCM", version: "1" };
 var BASE64URL = /^[A-Za-z0-9_-]+$/;
@@ -43,9 +43,65 @@ function isPlainObject(v) {
     return !!v && typeof v === "object" && !Array.isArray(v);
 }
 var MAX_PATH_STEPS = 16;
+var MAX_TEXT_STEPS = 2;
+var TEXT_STEP = /* @__PURE__ */ Object.freeze({ text: "json" });
+function isTextStep(step) {
+    return isPlainObject(step) && Object.keys(step).length === 1 && step.text === "json";
+}
+function sameStep(a, b) {
+    return a === b || isTextStep(a) && isTextStep(b);
+}
+function spellJson(parsed, form) {
+    const text = JSON.stringify(parsed);
+    if (form !== "php")
+        return text;
+    return text.replace(/\//g, "\\/").replace(/[\u0080-\uffff]/g, (unit) => `\\u${unit.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function jsonTextForm(value) {
+    if (typeof value !== "string" || !/^[[{]/.test(value))
+        return void 0;
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        return void 0;
+    }
+    if (parsed === null || typeof parsed !== "object")
+        return void 0;
+    for (const form of ["js", "php"]) {
+        try {
+            if (spellJson(parsed, form) === value)
+                return { parsed, form };
+        }
+        catch {
+            return void 0;
+        }
+    }
+    return void 0;
+}
+function jsonText(value) {
+    return jsonTextForm(value)?.parsed;
+}
 function isJsonPath(path) {
     return Array.isArray(path) && path.length <= MAX_PATH_STEPS && path.every((step) => typeof step === "string" ? step.length > 0 && !FORBIDDEN_KEYS.has(step) : Number.isSafeInteger(step) && step >= 0);
 }
+function isProfilePath(path) {
+    if (!Array.isArray(path) || path.length > MAX_PATH_STEPS)
+        return false;
+    let texts = 0;
+    for (const [i, step] of path.entries()) {
+        if (isTextStep(step)) {
+            texts += 1;
+            if (i === 0 || i === path.length - 1 || isTextStep(path[i - 1]) || texts > MAX_TEXT_STEPS)
+                return false;
+        }
+        else if (!isJsonPath([step])) {
+            return false;
+        }
+    }
+    return true;
+}
 function jsonAt(root, path) {
     let node = root;
     for (const step of path) {
@@ -60,6 +116,42 @@ function jsonAt(root, path) {
     }
     return { found: true, value: node };
 }
+function profileAt(root, path) {
+    if (!isProfilePath(path))
+        return { found: false };
+    let node = root;
+    for (const step of path) {
+        if (isTextStep(step)) {
+            const inner = jsonText(node);
+            if (inner === void 0)
+                return { found: false };
+            node = inner;
+            continue;
+        }
+        const at = jsonAt(node, [step]);
+        if (!at.found)
+            return { found: false };
+        node = at.value;
+    }
+    return { found: true, value: node };
+}
+function editAtProfilePath(root, path, edit) {
+    const at = profileAt(root, path);
+    if (!at.found || !isPlainObject(at.value))
+        return false;
+    const k = path.findIndex(isTextStep);
+    if (k === -1) {
+        edit(at.value);
+        return true;
+    }
+    const holder = jsonAt(root, path.slice(0, k - 1)).value;
+    const key = path[k - 1];
+    const text = jsonTextForm(holder[key]);
+    if (!text || !editAtProfilePath(text.parsed, path.slice(k + 1), edit))
+        return false;
+    holder[key] = spellJson(text.parsed, text.form);
+    return true;
+}
 function roundTrips(parsed, body) {
     try {
         return JSON.stringify(parsed) === body;
@@ -69,12 +161,12 @@ function roundTrips(parsed, body) {
     }
 }
 function sameSteps(a, b) {
-    return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((step, i) => step === b[i]);
+    return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((step, i) => sameStep(step, b[i]));
 }
 function pathsOverlap(a, b) {
     const n = Math.min(a.length, b.length);
     for (let i = 0; i < n; i += 1)
-        if (a[i] !== b[i])
+        if (!sameStep(a[i], b[i]))
             return false;
     return true;
 }
@@ -86,7 +178,12 @@ function valuesIgnoringCase(root, path) {
     for (const step of path) {
         const next = [];
         for (const node of nodes) {
-            if (typeof step === "number") {
+            if (isTextStep(step)) {
+                const inner = jsonText(node);
+                if (inner !== void 0)
+                    next.push(inner);
+            }
+            else if (typeof step === "number") {
                 if (Array.isArray(node) && Number.isSafeInteger(step) && step >= 0 && step < node.length)
                     next.push(node[step]);
             }
@@ -101,7 +198,7 @@ function valuesIgnoringCase(root, path) {
     return nodes;
 }
 function describePath(path) {
-    return path.length ? path.map((step) => typeof step === "number" ? `[${step}]` : `.${step}`).join("").replace(/^\./, "") : "(root)";
+    return path.length ? path.map((step) => typeof step === "number" ? `[${step}]` : isTextStep(step) ? "<json>" : `.${step}`).join("").replace(/^\./, "") : "(root)";
 }
 // src/substitution-primitives.js
 var SubstitutionError = class extends Error {
@@ -150,7 +247,7 @@ function swapMerchantHostedFields(body, spec, ciphertext = ADYEN_JWE) {
     const path = Array.isArray(spec.path) ? [...spec.path] : spec.path;
     const fields = isPlainObject(spec.fields) ? Object.fromEntries(Object.entries(spec.fields)) : null;
     const remove = Array.isArray(spec.remove) ? [...spec.remove] : spec.remove ?? [];
-    if (!isJsonPath(path))
+    if (!isProfilePath(path))
         throw new SubstitutionError("refusing substitution path");
     if (!fields || Object.keys(fields).length === 0)
         throw new SubstitutionError("substitutions carry no fields");
@@ -184,7 +281,7 @@ function swapMerchantHostedFields(body, spec, ciphertext = ADYEN_JWE) {
     }
     if (!isPlainObject(parsed))
         throw new SubstitutionError("the paused body is not a JSON object");
-    const holder = jsonAt(parsed, path);
+    const holder = profileAt(parsed, path);
     if (!holder.found || !isPlainObject(holder.value))
         throw new SubstitutionError(`the paused body has no object at ${describePath(path)}`);
     const swaps = /* @__PURE__ */ new Map();
@@ -236,15 +333,19 @@ function swapMerchantHostedFields(body, spec, ciphertext = ADYEN_JWE) {
     catch {
         throw new SubstitutionError("the substituted body is not JSON");
     }
-    const written = jsonAt(out, path);
+    const written = profileAt(out, path);
     if (!written.found || !isPlainObject(written.value) || names.some((name) => written.value[name] !== fields[name]) || dummies.some((dummy) => swapped.includes(dummy))) {
         throw new SubstitutionError(`the substitution did not land at ${describePath(path)}`);
     }
     if (remove.length === 0 && set.length === 0)
         return swapped;
-    for (const key of remove)
-        if (Object.prototype.hasOwnProperty.call(written.value, key))
-            delete written.value[key];
+    if (remove.length > 0 && !editAtProfilePath(out, path, (object) => {
+        for (const key of remove)
+            if (Object.prototype.hasOwnProperty.call(object, key))
+                delete object[key];
+    })) {
+        throw new SubstitutionError(`the substitution did not land at ${describePath(path)}`);
+    }
     for (const entry of set) {
         const parent = jsonAt(out, entry.path.slice(0, -1));
         if (!parent.found || !isPlainObject(parent.value))
@@ -733,6 +834,382 @@ var MERCHANT_HOSTED_PROFILES = /* @__PURE__ */ deepFreeze([
         facts: [{ path: ["sign_request", "raw_card_bin"], fact: "bin6" }],
         then: { method: "POST", path: "/cpp-paypage/v1/miles-plus-cash-authorise", query: {}, holder: [] },
         adyen: { environment: "live", clientKey: null, publicKeySha256: null }
+    },
+    {
+        // Read Oct 23, 2026, from teenage.engineering's shipped code and a card-free observe run on its
+        // US checkout (every non-GET aborted once the card form was reached, the placeholder typed into
+        // adyen-web's secured fields, nothing pressed). The store runs on Centra. Its checkout posts the
+        // order form to /_api/mw/selections/<selection>/payment2 with paymentInitiateOnly (no card), and
+        // Centra answers with the Adyen Drop-in's own script (adyen-web 6.41.1, environment live, this
+        // client key, holder name required, enableStoreDetails false). That script's onSubmit hands
+        // adyen-web's state.data to the page as paymentMethodSpecificFields (centra_checkout_payment_callback),
+        // and the page's finishAdyenPayment (assets/shop.*.js, cart-api.*.js) posts
+        // {paymentMethod: 'adyen-drop-in', address: <billing address>, paymentMethodSpecificFields:
+        // state.data, termsAndConditions: true, affiliate} to the same path through fetch, with no
+        // content type of its own (text/plain;charset=UTF-8 on the wire, a JSON text). The body names no
+        // amount: Centra charges the selection the path names, so the total comes from the selection's
+        // own answers below. The Drop-in's stored-payment update flow adds contracts. Public key read
+        // from checkoutshopper-live.adyen.com on 2026-10-23 (UTC). Not yet seen on the wire: the card
+        // request itself, which leaves only on the Pay press, so a press run confirms the body.
+        id: "teenage_engineering_centra_payment",
+        merchant: "teenage engineering",
+        status: "observe",
+        origins: [{ checkout: "https://teenage.engineering", endpoint: "https://teenage.engineering" }],
+        method: "POST",
+        path: "/_api/mw/selections/:selectionId/payment2",
+        query: {},
+        requires: [{ path: ["paymentMethod"], equals: "adyen-drop-in" }],
+        holder: ["paymentMethodSpecificFields", "paymentMethod"],
+        fields: {
+            encryptedCardNumber: "encryptedCardNumber",
+            encryptedExpiryMonth: "encryptedExpiryMonth",
+            encryptedExpiryYear: "encryptedExpiryYear",
+            encryptedSecurityCode: "encryptedSecurityCode"
+        },
+        // adyen-web 6.x stamps the dummy's brand after its bin lookup answers.
+        remove: ["brand"],
+        refuse: [
+            { path: ["paymentMethodSpecificFields", "storePaymentMethod"], when: "true" },
+            { path: ["paymentMethodSpecificFields", "paymentMethod", "storedPaymentMethodId"], when: "present" },
+            { path: ["paymentMethodSpecificFields", "paymentMethod", "recurringDetailReference"], when: "present" },
+            // The order form's own post on the same path initiates the payment and carries no card.
+            { path: ["paymentInitiateOnly"], when: "true" },
+            // The Drop-in's stored-payment update flow names subscription contracts the card would pay later.
+            { path: ["contracts"], when: "present" }
+        ],
+        amount: null,
+        // Read Oct 23, 2026 (the observe run above). Every selection call answers the whole selection
+        // as JSON: the read, the country and VAT changes, item quantities and the address step (which
+        // wraps it in `selection`). totals.grandTotalPriceAsNumber is what the Drop-in tells its own
+        // wallets to charge, in major units (2497.29 in the run), and currency names the currency. The
+        // card request's URL carries the same selection id, which binds each answer to it. Voucher,
+        // VAT-number and item-removal answers were not seen in the run, so they are not read: any of
+        // those calls after the chosen answer makes it stale.
+        amountSource: {
+            id: "teenage_engineering_selection_totals",
+            origin: "endpoint",
+            format: "json",
+            responses: [
+                { method: "GET", path: "/_api/mw/selections/:selectionId", query: {} },
+                { method: "PUT", path: "/_api/mw/selections/:selectionId", query: {} },
+                { method: "PUT", path: "/_api/mw/selections/:selectionId/address", query: {}, at: ["selection"] },
+                { method: "DELETE", path: "/_api/mw/selections/:selectionId/vat", query: {} },
+                { method: "POST", path: "/_api/mw/selections/:selectionId/items/:itemId/quantity/:quantity", query: {} },
+                { method: "DELETE", path: "/_api/mw/selections/:selectionId/items/:itemId/quantity/:quantity", query: {} }
+            ],
+            total: { path: ["totals", "grandTotalPriceAsNumber"], format: "number" },
+            unit: "major",
+            currency: "USD",
+            currencyPath: ["currency"],
+            bind: [{ placeholder: "selectionId", cardPlaceholder: "selectionId" }],
+            voidedBy: [
+                { method: "POST", path: "/_api/mw/selections/:selectionId/vouchers/:voucherCode", query: {} },
+                { method: "DELETE", path: "/_api/mw/selections/:selectionId/vouchers", query: {} },
+                { method: "POST", path: "/_api/mw/selections/:selectionId/vat/:vatNumber", query: {} },
+                { method: "DELETE", path: "/_api/mw/selections/:selectionId/items/:itemId", query: {} }
+            ],
+            maxAgeMs: 9e5
+        },
+        adyen: {
+            environment: "live",
+            clientKey: "live_FAQ7CUZM7JAO7K6CGXI67KMZ64K35AVH",
+            publicKeySha256: "b99a44120544b609c01ede6041c82b481d23423d7e956355022a5d7f362b5349"
+        }
+    },
+    {
+        // Read Oct 23, 2026, from www.scheels.com's shipped checkout chunk (a Next.js page on commercetools
+        // Frontastic) and a card-free observe run on its guest checkout (every non-GET aborted once the card
+        // form was reached, the placeholder typed into adyen-web 5.5.3's secured fields, Review Order pressed:
+        // the address save before it was aborted too, so the card request was not reached). The Card
+        // component's onSubmit (showPayButton false; the page submits it on Review Order) sets
+        // state.data.paymentMethod.brand from onBrand, then calls the Frontastic action
+        // /cart/setAdyenCreditCard with {payment: {paymentMethod: 'CREDIT_CARD', bin (onBinValue's six
+        // digits, or onFieldValid's issuerBin), lastFour (onFieldValid's endDigits), deviceFingerprint (when
+        // the page has one)}, state: JSON.stringify(state)}. The SDK posts JSON.stringify(payload) to
+        // apihub.scheels.com/frontastic/action/cart/setAdyenCreditCard (its path joiner collapses the
+        // action's leading '/') with content-type application/json and the Frontastic-Session header. So the
+        // four JWEs sit in adyen-web's state, inside the `state` text. bin and lastFour describe the dummy:
+        // the approved card's BIN6 and last four are written there. The body names no amount: the cart the
+        // session holds is charged when Place Order sends cart/checkout, which carries no card. Public key
+        // read from checkoutshopper-live-us.adyen.com on 2026-10-23 (UTC).
+        id: "scheels_frontastic_adyen_card",
+        merchant: "SCHEELS",
+        status: "observe",
+        origins: [{ checkout: "https://www.scheels.com", endpoint: "https://apihub.scheels.com" }],
+        method: "POST",
+        path: "/frontastic/action/cart/setAdyenCreditCard",
+        query: {},
+        requires: [{ path: ["payment", "paymentMethod"], equals: "CREDIT_CARD" }],
+        holder: ["state", TEXT_STEP, "data", "paymentMethod"],
+        fields: {
+            encryptedCardNumber: "encryptedCardNumber",
+            encryptedExpiryMonth: "encryptedExpiryMonth",
+            encryptedExpiryYear: "encryptedExpiryYear",
+            encryptedSecurityCode: "encryptedSecurityCode"
+        },
+        // The page copies onBrand's code (the dummy's) into the state before it is stringified.
+        remove: ["brand"],
+        refuse: [
+            // enableStoreDetails is on for a signed-in shopper only.
+            { path: ["state", TEXT_STEP, "data", "storePaymentMethod"], when: "true" },
+            { path: ["state", TEXT_STEP, "data", "paymentMethod", "storedPaymentMethodId"], when: "present" },
+            { path: ["state", TEXT_STEP, "data", "paymentMethod", "recurringDetailReference"], when: "present" }
+        ],
+        amount: null,
+        // Read Oct 23, 2026 (the observe run above). Every cart action on the checkout page answers the
+        // whole cart, camelCase JSON at the root (addToCart wraps it in `cart`); summary.amountDue is what
+        // the payment step shows as "Amount due" and what is left for the card, in cents (6538 in the run,
+        // the run's total). The cart is the session's, so an answer is tied to the card request by its
+        // page. A gift card or another tender lowers the amount due below the order's gross total and is
+        // refused until a HAR shows which one the charge follows.
+        amountSource: {
+            id: "scheels_cart_amount_due",
+            origin: "endpoint",
+            format: "json",
+            responses: [
+                { method: "POST", path: "/frontastic/action/cart/updateCart", query: {} },
+                { method: "POST", path: "/frontastic/action/cart/setCheckoutDefaults", query: {} },
+                { method: "POST", path: "/frontastic/action/cart/clean", query: {} },
+                { method: "POST", path: "/frontastic/action/cart/addToCart", query: {}, at: ["cart"] },
+                { method: "POST", path: "/frontastic/action/route/addRouteProtection", query: {} },
+                { method: "POST", path: "/frontastic/action/route/removeRouteProtection", query: {} }
+            ],
+            total: { path: ["summary", "amountDue", "centAmount"], format: "number" },
+            unit: "minor",
+            currency: "USD",
+            currencyPath: ["summary", "amountDue", "currencyCode"],
+            bind: [{ samePage: true }],
+            requires: [{ path: ["summary", "amountDue", "centAmount"], equalsPath: ["summary", "grossTotal", "centAmount"] }],
+            refuse: [
+                { path: ["summary", "giftCardTotal", "centAmount"], when: "nonzero" },
+                { path: ["summary", "tenderTotal", "centAmount"], when: "nonzero" }
+            ],
+            // Cart changes whose answers were not seen in the run: any of them after the chosen answer makes it stale.
+            voidedBy: [
+                { method: "POST", path: "/frontastic/action/cart/redeemDiscountCode", query: {} },
+                { method: "POST", path: "/frontastic/action/cart/removeDiscountCode", query: {} },
+                { method: "POST", path: "/frontastic/action/cart/updateItem", query: {} },
+                { method: "POST", path: "/frontastic/action/cart/removeItem", query: {} },
+                { method: "POST", path: "/frontastic/action/cart/setShippingMethod", query: {} },
+                { method: "POST", path: "/frontastic/action/sameDay/setTip", query: {} }
+            ],
+            maxAgeMs: 9e5
+        },
+        facts: [
+            { path: ["payment", "bin"], fact: "bin6" },
+            { path: ["payment", "lastFour"], fact: "last4" }
+        ],
+        adyen: {
+            environment: "live-us",
+            clientKey: "live_7NQ5GGRX7ZD3PJCWBGV6WELTMMA3GBOO",
+            publicKeySha256: "9d6aa672c539f6e76c082beed1fcbe089af526b87c9ea6878ab3671355089065"
+        }
+    },
+    {
+        // Read Oct 23, 2026, from www.buff.com's shipped US checkout (Magento on Hyvä Checkout with
+        // Magewire, Adyen's Hyvä module, adyen-web 5.5.3) and a card-free observe run on its guest checkout
+        // (every non-GET aborted once the card form was reached, the placeholder typed into the secured
+        // fields, nothing pressed). The card renderer keeps adyen-web's state.data from onChange and the
+        // brand code onBrand maps (amex AE, visa VI, mc MC). Place Order calls the adyen_cc component's
+        // placeOrder({stateData, ccType, publicHash: null, extension_attributes}) through Magewire, which
+        // posts JSON.stringify({fingerprint, serverMemo, updates: [{type: 'callMethod', payload: {id,
+        // method: 'placeOrder', params: [that object]}}]}) to
+        // /us/magewire/post/livewire/message/checkout.payment.methods.adyen_cc with content-type
+        // application/json and X-CSRF-TOKEN. The server charges the quote there. ccType describes the
+        // dummy: the approved card's code is written there. The body's own serverMemo, which Magewire signs
+        // with its checksum, carries the component's paymentResponse as JSON text, and its
+        // paymentMethodsExtraDetails.scheme.configuration.amount is the quote's grand total in cents: it
+        // followed the run's total from 8600 to 9342 once shipping and tax were set. A saved card sends a
+        // publicHash and enableStoreDetails is off for a guest. Public key read from
+        // checkoutshopper-live.adyen.com on 2026-10-23 (UTC). Not yet seen on the wire: the card request
+        // itself, which leaves only on Place Order.
+        id: "buff_magewire_adyen_cc",
+        merchant: "Buff",
+        status: "observe",
+        origins: [{ checkout: "https://www.buff.com", endpoint: "https://www.buff.com" }],
+        method: "POST",
+        path: "/us/magewire/post/livewire/message/checkout.payment.methods.adyen_cc",
+        query: {},
+        requires: [
+            { path: ["fingerprint", "name"], equals: "checkout.payment.methods.adyen_cc" },
+            { path: ["updates", 0, "type"], equals: "callMethod" },
+            { path: ["updates", 0, "payload", "method"], equals: "placeOrder" }
+        ],
+        holder: ["updates", 0, "payload", "params", 0, "stateData", "paymentMethod"],
+        fields: {
+            encryptedCardNumber: "encryptedCardNumber",
+            encryptedExpiryMonth: "encryptedExpiryMonth",
+            encryptedExpiryYear: "encryptedExpiryYear",
+            encryptedSecurityCode: "encryptedSecurityCode"
+        },
+        // adyen-web 5.x stamps the dummy's brand into state.data.
+        remove: ["brand"],
+        refuse: [
+            // One call per message: a second update or a second argument is not the reviewed request.
+            { path: ["updates", 1], when: "present" },
+            { path: ["updates", 0, "payload", "params", 1], when: "present" },
+            // A saved card's public hash, or a card kept for later.
+            { path: ["updates", 0, "payload", "params", 0, "publicHash"], when: "true" },
+            { path: ["updates", 0, "payload", "params", 0, "stateData", "storePaymentMethod"], when: "true" },
+            { path: ["updates", 0, "payload", "params", 0, "stateData", "paymentMethod", "storedPaymentMethodId"], when: "present" },
+            { path: ["updates", 0, "payload", "params", 0, "stateData", "paymentMethod", "recurringDetailReference"], when: "present" }
+        ],
+        amount: ["serverMemo", "data", "paymentResponse", TEXT_STEP, "paymentMethodsExtraDetails", "scheme", "configuration", "amount"],
+        facts: [
+            // The renderer's own map (componentHandler.getCcCodeByAltCode); Buff's card list names these three.
+            { path: ["updates", 0, "payload", "params", 0, "ccType"], fact: "brand", map: { visa: "VI", mastercard: "MC", amex: "AE" } }
+        ],
+        adyen: {
+            environment: "live",
+            clientKey: "live_5NIC7BWSNFDX3GBSKL5XCZ4B4YCIWLKP",
+            publicKeySha256: "3f7e1740684cb4964aa8bb7185b9718564fc0957cfc83e096f7bf016d6a7d001"
+        }
+    },
+    {
+        // Read Oct 23, 2026, from www.plein.com's shipped US checkout (Salesforce Commerce Cloud SiteGenesis with Adyen's
+        // int_adyen cartridge, adyen-web 4.9.0) and the press lane's stored copy of the card request the page sent with the
+        // placeholder typed (aborted unsent by the checkout SDK's hold; values sanitized, field names and shape kept). The
+        // card component's onSubmit writes JSON.stringify(state.data) into the hidden field dwfrm_adyPaydata_adyenStateData,
+        // and CONTINUE TO PLACE ORDER submits the billing form: a top-level form post (application/x-www-form-urlencoded) to
+        // /us/billing/. So the four JWEs sit in adyen-web's state, inside that field's JSON text, under paymentMethod
+        // (adyen-web 4.9 writes no brand there; one a later version writes is dropped). Beside the state the page writes
+        // onBrand's code into dwfrm_billing_paymentMethods_creditCard_type and twelve '*' with onFieldValid's last four into
+        // dwfrm_billing_paymentMethods_creditCard_number, both describing the dummy: the approved card's are written there.
+        // The form also carries its csrf_token and its submit button's name twice (dwfrm_billing_save); a repeated field
+        // never reaches a rule. enableStoreDetails is on for a signed-in shopper only. The body names no amount, and the
+        // page's total sits only in its analytics block (tc_vars.order_amount_ati_with_sf), which no reviewed rule reads,
+        // so amountPending holds the profile in observe. Public key read from checkoutshopper-live-us.adyen.com on
+        // 2026-10-23 (UTC).
+        id: "plein_sfcc_billing_form",
+        merchant: "Philipp Plein",
+        status: "observe",
+        origins: [{ checkout: "https://www.plein.com", endpoint: "https://www.plein.com" }],
+        method: "POST",
+        path: "/us/billing/",
+        query: {},
+        encoding: "form",
+        requires: [
+            { path: ["dwfrm_billing_paymentMethods_selectedPaymentMethodID"], equals: "AdyenComponent" },
+            { path: ["brandCode"], equals: "scheme" }
+        ],
+        holder: ["dwfrm_adyPaydata_adyenStateData", TEXT_STEP, "paymentMethod"],
+        fields: {
+            encryptedCardNumber: "encryptedCardNumber",
+            encryptedExpiryMonth: "encryptedExpiryMonth",
+            encryptedExpiryYear: "encryptedExpiryYear",
+            encryptedSecurityCode: "encryptedSecurityCode"
+        },
+        remove: ["brand"],
+        refuse: [
+            { path: ["dwfrm_adyPaydata_adyenStateData", TEXT_STEP, "storePaymentMethod"], when: "true" },
+            { path: ["dwfrm_adyPaydata_adyenStateData", TEXT_STEP, "paymentMethod", "storedPaymentMethodId"], when: "present" },
+            { path: ["dwfrm_adyPaydata_adyenStateData", TEXT_STEP, "paymentMethod", "recurringDetailReference"], when: "present" }
+        ],
+        amount: null,
+        amountPending: "the page names its total only in its analytics block (tc_vars.order_amount_ati_with_sf), which no reviewed rule reads",
+        facts: [
+            // onBrand's adyen-web codes for the networks a US checkout takes.
+            { path: ["dwfrm_billing_paymentMethods_creditCard_type"], fact: "brand", map: { visa: "visa", mastercard: "mc", amex: "amex", discover: "discover" } },
+            { path: ["dwfrm_billing_paymentMethods_creditCard_number"], fact: "masked_last4" }
+        ],
+        adyen: {
+            environment: "live-us",
+            clientKey: "live_P7RRXHAHEVFTLPS3XUD3ML7ZWUEZ6BXN",
+            publicKeySha256: "3e0d4366563b714feb233d12ce98adcef3b606381596e097ca3a8123b9a91d67"
+        }
+    },
+    {
+        // Read Nov 3, 2026, from www.lego.com's shipped US checkout (a Next.js app under /checkout, Apollo GraphQL) and a
+        // card-free run on its guest checkout up to the card form (test contact details, no card typed, nothing pressed;
+        // every non-GET to adyen.com aborted). The checkout's cart answer (CheckoutV2State, paymentMethodsV3.primary) names
+        // CREDIT_CARD_ADYEN with environment 'live' and this client key, and the card form is adyen-web 6's secured fields
+        // (securedFields 6.0.0 on checkoutshopper-live.adyen.com). Place order's handler (chunk 487, the CreditCard submit)
+        // copies encryptedCardNumber, encryptedExpiryMonth, encryptedExpiryYear, encryptedSecurityCode, type and holderName
+        // out of adyen-web's state.data.paymentMethod, with no brand, and sends the Apollo mutation AddAdyenPayment with
+        // variables {input: {paymentReference: <the cart's orderNumber>, telephoneNumber, browserInfo, origin, paymentMethod,
+        // returnUrl, storePaymentMethod, tracking}}. Apollo posts {operationName, variables, query} as JSON to the gateway
+        // (www.lego.com/checkout/api/graphql), whose link adds the operation name to the path: every checkout operation in
+        // the run went to /checkout/api/graphql/<operationName>. So the card request is Lego's own server, Adyen's Advanced
+        // flow. A saved card goes as AddAdyenSavedCardPaymentV2, a gift card as AddGiftCardPaymentV2Mutation, each on its
+        // own path. The body names no amount. Public key read from checkoutshopper-live.adyen.com on 2026-11-03 (UTC). Not
+        // yet seen on the wire: the card request itself, which leaves only on Place order.
+        // Enabled on Nov 4, 2026 under D1, so the Vault's bundled copy of this table carries it at the next Vault release. No
+        // company is admitted yet: Agentcard's proof company joins through a flip in backend merchant-profile-orgs.ts after that
+        // release. Felipe's approval of this change is his D1 decision for LEGO, and Karen's its PCI review.
+        // No afterPayment reader yet: nobody has seen what LEGO answers after a placed order, so the charge is not compared with
+        // the approved amount after payment and merchantChargeVerdict has nothing to read (Greptile on this change). The amount
+        // is checked before payment (amountSource below). Until a reviewed afterPayment lands, built from the response the first
+        // live run captures, Agentcard's proof company makes no purchase LEGO's Adyen approves: its runs use a card Adyen declines.
+        id: "lego_checkout_add_adyen_payment",
+        merchant: "LEGO",
+        status: "enabled",
+        origins: [{ checkout: "https://www.lego.com", endpoint: "https://www.lego.com" }],
+        method: "POST",
+        path: "/checkout/api/graphql/AddAdyenPayment",
+        query: {},
+        requires: [
+            { path: ["operationName"], equals: "AddAdyenPayment" },
+            { path: ["variables", "input", "paymentMethod", "type"], equals: "scheme" }
+        ],
+        holder: ["variables", "input", "paymentMethod"],
+        fields: {
+            encryptedCardNumber: "encryptedCardNumber",
+            encryptedExpiryMonth: "encryptedExpiryMonth",
+            encryptedExpiryYear: "encryptedExpiryYear",
+            encryptedSecurityCode: "encryptedSecurityCode"
+        },
+        // The page copies no brand out of adyen-web's state.
+        remove: [],
+        refuse: [
+            { path: ["variables", "input", "storePaymentMethod"], when: "true" },
+            { path: ["variables", "input", "paymentMethod", "storedPaymentMethodId"], when: "present" },
+            { path: ["variables", "input", "paymentMethod", "recurringDetailReference"], when: "present" }
+        ],
+        amount: null,
+        // Read Nov 3, 2026 (the run above). The checkout's cart answers carry the whole cart: CheckoutV2State at
+        // data.me.cart, the address step at data.updateCartAddresses and the shipping step at data.setCartShippingMethod.
+        // remainingTotalToPay is what is left for the card, in cents (1191 in the run, the page's Order Total $11.91), and
+        // orderNumber is the paymentReference the card request sends, which ties each answer to it. A gift card already
+        // applied shows in payments and lowers what is left below the order's total, so a cart with one is refused. Cart
+        // changes whose answers were not seen in the run make the chosen answer stale.
+        amountSource: {
+            id: "lego_cart_remaining_total",
+            origin: "endpoint",
+            format: "json",
+            responses: [
+                { method: "POST", path: "/checkout/api/graphql/CheckoutV2State", query: {}, at: ["data", "me", "cart"] },
+                { method: "POST", path: "/checkout/api/graphql/SetAddressMutation", query: {}, at: ["data", "updateCartAddresses"] },
+                { method: "POST", path: "/checkout/api/graphql/SetShippingMethodV2Mutation", query: {}, at: ["data", "setCartShippingMethod"] }
+            ],
+            total: { path: ["remainingTotalToPay", "centAmount"], format: "number" },
+            unit: "minor",
+            currency: "USD",
+            currencyPath: ["remainingTotalToPay", "currencyCode"],
+            bind: [{ source: ["orderNumber"], card: ["variables", "input", "paymentReference"] }],
+            refuse: [
+                { path: ["payments"], when: "nonEmpty" },
+                // A GraphQL error result is not a total, even beside partial data.
+                { path: ["errors"], when: "present", root: true }
+            ],
+            voidedBy: [
+                { method: "POST", path: "/checkout/api/graphql/AddGiftCardPaymentV2Mutation", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/AddGiftCardOnlyPayment", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/RemoveGiftCardPaymentMutations", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/AddVipLineItemCheckout", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/EditVipLineItemCheckout", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/RemoveVipPointsLineItemCheckout", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/SetShippingMethodOnlyMutation", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/SetAddressMutationWithoutEmail", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/SetAddressesMutationV2", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/saveCollectionPointMutation", query: {} }
+            ],
+            maxAgeMs: 9e5
+        },
+        adyen: {
+            environment: "live",
+            clientKey: "live_P34BZ2Q6ANHNHAUEKOFOX3IMHQHZ75ES",
+            publicKeySha256: "5659f43faa157b82b45844fdf35382a8b83b7bb24662b5e0fbcca15fd120bcc2"
+        }
     }
 ]);
 function adyenKeyHost(environment) {
@@ -762,7 +1239,7 @@ var CARD_BRANDS = /* @__PURE__ */ deepFreeze([
 ]);
 var BRAND_CODE = /^[A-Za-z0-9][A-Za-z0-9 ._-]{0,31}$/;
 var MAX_FACTS = 8;
-function factRefusal(entry, i, holder, besideHolder, reviewed) {
+function factRefusal(entry, i, holder, reviewed) {
     const label = `fact ${i}`;
     if (!isPlainObject(entry))
         return `${label} is not an object`;
@@ -777,9 +1254,9 @@ function factRefusal(entry, i, holder, besideHolder, reviewed) {
         return `${label}'s path is not a JSON path ending in a key`;
     const key = path[path.length - 1];
     const parent = path.slice(0, -1);
-    const inHolder = sameSteps(parent, holder);
-    if (!inHolder && !(besideHolder && sameSteps(parent, besideHolder) && key !== holder[holder.length - 1])) {
-        return `${label}'s path ${describePath(path)} is neither in the holder nor beside it`;
+    const inHolder = sameSteps(parent, holder) && !holder.some(isTextStep);
+    if (!inHolder && pathsOverlap(path, holder)) {
+        return `${label}'s path ${describePath(path)} reaches the card object or what holds it`;
     }
     if (inHolder && reviewed.written.includes(key))
         return `${label} writes over an encrypted field or a removed key`;
@@ -805,16 +1282,15 @@ function merchantProfileFactsRefusal(profile) {
     if (!Array.isArray(facts) || facts.length > MAX_FACTS)
         return `facts is not a list of at most ${MAX_FACTS}`;
     const holder = profile.holder;
-    if (!isJsonPath(holder))
+    if (!isProfilePath(holder))
         return "the holder is not a JSON path";
-    const besideHolder = holder.length > 0 && typeof holder[holder.length - 1] === "string" ? holder.slice(0, -1) : null;
     const list = (value) => Array.isArray(value) ? value : [];
     const reviewed = {
         written: [...isPlainObject(profile.fields) ? Object.values(profile.fields) : [], ...list(profile.remove)],
         read: [...list(profile.requires), ...list(profile.refuse)].map((rule) => rule?.path).concat(merchantBodyAmountPaths(profile), merchantAmountCardPaths(profile)).filter(Array.isArray)
     };
     for (const [i, entry] of facts.entries()) {
-        const refusal = factRefusal(entry, i, holder, besideHolder, reviewed);
+        const refusal = factRefusal(entry, i, holder, reviewed);
         if (refusal)
             return refusal;
         const earlier = facts.slice(0, i).find((other) => isPlainObject(other) && Array.isArray(other.path) && pathsOverlap(other.path, entry.path));
@@ -826,23 +1302,74 @@ function merchantProfileFactsRefusal(profile) {
 function merchantProfileRecognizerById(id) {
     return typeof id === "string" ? MERCHANT_PROFILE_RECOGNIZERS.find((entry) => entry.id === id) ?? null : null;
 }
-function merchantBodyRefusal(profile, body) {
-    const p = merchantProfileRecognizerById(typeof profile === "string" ? profile : profile?.id);
-    if (!p)
-        throw new Error("Refusing to pay: unknown merchant profile.");
+function textRefusal(p, parsed) {
+    const amount = p.amount;
+    const amountPaths = Array.isArray(amount) ? [amount] : isPlainObject(amount) ? [amount.value, amount.currency] : [];
+    const paths = [p.holder, ...p.requires.map((rule) => rule.path), ...p.refuse.map((rule) => rule.path), ...amountPaths].filter(Array.isArray);
+    for (const path of paths) {
+        for (const [k, step] of path.entries()) {
+            if (!isTextStep(step))
+                continue;
+            const before = path.slice(0, k);
+            if (valuesIgnoringCase(parsed, before).some((value) => valuesIgnoringCase(value, [TEXT_STEP]).length === 0)) {
+                return `the paused body's ${describePath(before)} is not JSON text written the way JSON.stringify or PHP's json_encode writes it, so ${p.merchant}'s rules cannot read it`;
+            }
+        }
+    }
+    return null;
+}
+function formBodyView(body) {
+    if (typeof body !== "string" || body === "")
+        return void 0;
+    let params;
+    try {
+        params = new URLSearchParams(body);
+    }
+    catch {
+        return void 0;
+    }
+    if (params.toString() !== body)
+        return void 0;
+    const view = /* @__PURE__ */ Object.create(null);
+    for (const [name, value] of params) {
+        if (!Object.prototype.hasOwnProperty.call(view, name))
+            view[name] = value;
+        else
+            view[name] = Array.isArray(view[name]) ? [...view[name], value] : [view[name], value];
+    }
+    return view;
+}
+function readProfileBody(p, body) {
+    if (p.encoding === "form") {
+        const view = formBodyView(body);
+        return view === void 0 ? { refusal: "the paused body is not a form written the way a browser writes it, so its rules cannot be read" } : { parsed: view };
+    }
     let parsed;
     try {
         parsed = typeof body === "string" ? JSON.parse(body) : void 0;
     }
     catch {
-        return "the paused body is not JSON";
+        return { refusal: "the paused body is not JSON" };
     }
     if (!isPlainObject(parsed))
-        return "the paused body is not a JSON object";
+        return { refusal: "the paused body is not a JSON object" };
     if (!roundTrips(parsed, body))
-        return "the paused body does not round-trip through JSON, so its rules cannot be read";
+        return { refusal: "the paused body does not round-trip through JSON, so its rules cannot be read" };
+    return { parsed };
+}
+function merchantBodyRefusal(profile, body) {
+    const p = merchantProfileRecognizerById(typeof profile === "string" ? profile : profile?.id);
+    if (!p)
+        throw new Error("Refusing to pay: unknown merchant profile.");
+    const read = readProfileBody(p, body);
+    if (read.refusal)
+        return read.refusal;
+    const parsed = read.parsed;
+    const unreadText = textRefusal(p, parsed);
+    if (unreadText)
+        return unreadText;
     for (const rule of p.requires) {
-        const at = jsonAt(parsed, rule.path);
+        const at = profileAt(parsed, rule.path);
         if (!at.found || at.value !== rule.equals || valuesIgnoringCase(parsed, rule.path).some((value) => value !== rule.equals)) {
             return `the paused body is not ${p.merchant}'s card request: ${describePath(rule.path)} is not ${JSON.stringify(rule.equals)}`;
         }