@agent-cards/sdk 0.23.28 → 0.24.1

package/dist/adyen-merchant-hosted.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: e15beada28ae21bc7d0145bea84f12379a45a8815f0cbb1405a2a78b14b34e4f
+// artifact-sha256: 7f066dc9de1de76fd2dce4d9ac940e653010b8cd3e9d45c3bb4fd04d006f7c16
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -16,9 +16,65 @@ function isPlainObject(v) {
     return !!v && typeof v === "object" && !Array.isArray(v);
 }
 var MAX_PATH_STEPS = 16;
+var MAX_TEXT_STEPS = 2;
+var TEXT_STEP = /* @__PURE__ */ Object.freeze({ text: "json" });
+function isTextStep(step) {
+    return isPlainObject(step) && Object.keys(step).length === 1 && step.text === "json";
+}
+function sameStep(a, b) {
+    return a === b || isTextStep(a) && isTextStep(b);
+}
+function spellJson(parsed, form) {
+    const text = JSON.stringify(parsed);
+    if (form !== "php")
+        return text;
+    return text.replace(/\//g, "\\/").replace(/[\u0080-\uffff]/g, (unit) => `\\u${unit.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function jsonTextForm(value) {
+    if (typeof value !== "string" || !/^[[{]/.test(value))
+        return void 0;
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        return void 0;
+    }
+    if (parsed === null || typeof parsed !== "object")
+        return void 0;
+    for (const form of ["js", "php"]) {
+        try {
+            if (spellJson(parsed, form) === value)
+                return { parsed, form };
+        }
+        catch {
+            return void 0;
+        }
+    }
+    return void 0;
+}
+function jsonText(value) {
+    return jsonTextForm(value)?.parsed;
+}
 function isJsonPath(path) {
     return Array.isArray(path) && path.length <= MAX_PATH_STEPS && path.every((step) => typeof step === "string" ? step.length > 0 && !FORBIDDEN_KEYS.has(step) : Number.isSafeInteger(step) && step >= 0);
 }
+function isProfilePath(path) {
+    if (!Array.isArray(path) || path.length > MAX_PATH_STEPS)
+        return false;
+    let texts = 0;
+    for (const [i, step] of path.entries()) {
+        if (isTextStep(step)) {
+            texts += 1;
+            if (i === 0 || i === path.length - 1 || isTextStep(path[i - 1]) || texts > MAX_TEXT_STEPS)
+                return false;
+        }
+        else if (!isJsonPath([step])) {
+            return false;
+        }
+    }
+    return true;
+}
 function jsonAt(root, path) {
     let node = root;
     for (const step of path) {
@@ -33,6 +89,25 @@ function jsonAt(root, path) {
     }
     return { found: true, value: node };
 }
+function profileAt(root, path) {
+    if (!isProfilePath(path))
+        return { found: false };
+    let node = root;
+    for (const step of path) {
+        if (isTextStep(step)) {
+            const inner = jsonText(node);
+            if (inner === void 0)
+                return { found: false };
+            node = inner;
+            continue;
+        }
+        const at = jsonAt(node, [step]);
+        if (!at.found)
+            return { found: false };
+        node = at.value;
+    }
+    return { found: true, value: node };
+}
 function roundTrips(parsed, body) {
     try {
         return JSON.stringify(parsed) === body;
@@ -44,7 +119,7 @@ function roundTrips(parsed, body) {
 function pathsOverlap(a, b) {
     const n = Math.min(a.length, b.length);
     for (let i = 0; i < n; i += 1)
-        if (a[i] !== b[i])
+        if (!sameStep(a[i], b[i]))
             return false;
     return true;
 }
@@ -56,7 +131,12 @@ function valuesIgnoringCase(root, path) {
     for (const step of path) {
         const next = [];
         for (const node of nodes) {
-            if (typeof step === "number") {
+            if (isTextStep(step)) {
+                const inner = jsonText(node);
+                if (inner !== void 0)
+                    next.push(inner);
+            }
+            else if (typeof step === "number") {
                 if (Array.isArray(node) && Number.isSafeInteger(step) && step >= 0 && step < node.length)
                     next.push(node[step]);
             }
@@ -71,7 +151,7 @@ function valuesIgnoringCase(root, path) {
     return nodes;
 }
 function describePath(path) {
-    return path.length ? path.map((step) => typeof step === "number" ? `[${step}]` : `.${step}`).join("").replace(/^\./, "") : "(root)";
+    return path.length ? path.map((step) => typeof step === "number" ? `[${step}]` : isTextStep(step) ? "<json>" : `.${step}`).join("").replace(/^\./, "") : "(root)";
 }
 // src/url-template.js
 var PLACEHOLDER_VALUE = /^[A-Za-z0-9._~@+-]{1,256}$/;
@@ -316,6 +396,7 @@ function listRefusal(list, max, label, each, { optional = true, min = 0 } = {})
     return null;
 }
 var pathRefusal = (path, label) => isJsonPath(path) && path.length > 0 ? null : `${label} is not a JSON path of keys and indices`;
+var bodyPathRefusal = (path, label) => isProfilePath(path) && path.length > 0 ? null : `${label} is not a JSON path of keys and indices`;
 function equalsRuleRefusal(rule, label, { root }) {
     const byPath = root && isPlainObject(rule) && has(rule, "equalsPath");
     if (byPath && has(rule, "equals"))
@@ -755,11 +836,11 @@ function merchantBodyAmountRefusal(profile) {
     if (amount === null)
         return null;
     if (Array.isArray(amount))
-        return pathRefusal(amount, "the body amount");
+        return bodyPathRefusal(amount, "the body amount");
     const members = membersRefusal(amount, BODY_AMOUNT_MEMBERS, BODY_AMOUNT_MEMBERS, "the body amount");
     if (members)
         return members;
-    const paths = pathRefusal(amount.value, "the body amount's value") ?? pathRefusal(amount.currency, "the body amount's currency");
+    const paths = bodyPathRefusal(amount.value, "the body amount's value") ?? bodyPathRefusal(amount.currency, "the body amount's currency");
     if (paths)
         return paths;
     if (pathsOverlap(amount.value, amount.currency))
@@ -780,16 +861,16 @@ function readMerchantBodyAmount(profile, body) {
     if (amount === null)
         return { kind: "unnamed" };
     if (Array.isArray(amount)) {
-        const at = jsonAt(body, amount);
+        const at = profileAt(body, amount);
         if (!at.found)
             return { kind: "absent" };
         const named = adyenAmount(at.value);
         return named ? { kind: "amount", amountCents: named.minor, currency: named.currency } : { kind: "unreadable" };
     }
-    const value = jsonAt(body, amount.value);
+    const value = profileAt(body, amount.value);
     if (!value.found)
         return { kind: "absent" };
-    const currency = jsonAt(body, amount.currency);
+    const currency = profileAt(body, amount.currency);
     if (!currency.found || typeof currency.value !== "string" || !/^[A-Za-z]{3}$/.test(currency.value))
         return { kind: "unreadable" };
     const code = currency.value.toUpperCase();
@@ -1542,6 +1623,382 @@ var MERCHANT_HOSTED_PROFILES = /* @__PURE__ */ deepFreeze([
         facts: [{ path: ["sign_request", "raw_card_bin"], fact: "bin6" }],
         then: { method: "POST", path: "/cpp-paypage/v1/miles-plus-cash-authorise", query: {}, holder: [] },
         adyen: { environment: "live", clientKey: null, publicKeySha256: null }
+    },
+    {
+        // Read Oct 23, 2026, from teenage.engineering's shipped code and a card-free observe run on its
+        // US checkout (every non-GET aborted once the card form was reached, the placeholder typed into
+        // adyen-web's secured fields, nothing pressed). The store runs on Centra. Its checkout posts the
+        // order form to /_api/mw/selections/<selection>/payment2 with paymentInitiateOnly (no card), and
+        // Centra answers with the Adyen Drop-in's own script (adyen-web 6.41.1, environment live, this
+        // client key, holder name required, enableStoreDetails false). That script's onSubmit hands
+        // adyen-web's state.data to the page as paymentMethodSpecificFields (centra_checkout_payment_callback),
+        // and the page's finishAdyenPayment (assets/shop.*.js, cart-api.*.js) posts
+        // {paymentMethod: 'adyen-drop-in', address: <billing address>, paymentMethodSpecificFields:
+        // state.data, termsAndConditions: true, affiliate} to the same path through fetch, with no
+        // content type of its own (text/plain;charset=UTF-8 on the wire, a JSON text). The body names no
+        // amount: Centra charges the selection the path names, so the total comes from the selection's
+        // own answers below. The Drop-in's stored-payment update flow adds contracts. Public key read
+        // from checkoutshopper-live.adyen.com on 2026-10-23 (UTC). Not yet seen on the wire: the card
+        // request itself, which leaves only on the Pay press, so a press run confirms the body.
+        id: "teenage_engineering_centra_payment",
+        merchant: "teenage engineering",
+        status: "observe",
+        origins: [{ checkout: "https://teenage.engineering", endpoint: "https://teenage.engineering" }],
+        method: "POST",
+        path: "/_api/mw/selections/:selectionId/payment2",
+        query: {},
+        requires: [{ path: ["paymentMethod"], equals: "adyen-drop-in" }],
+        holder: ["paymentMethodSpecificFields", "paymentMethod"],
+        fields: {
+            encryptedCardNumber: "encryptedCardNumber",
+            encryptedExpiryMonth: "encryptedExpiryMonth",
+            encryptedExpiryYear: "encryptedExpiryYear",
+            encryptedSecurityCode: "encryptedSecurityCode"
+        },
+        // adyen-web 6.x stamps the dummy's brand after its bin lookup answers.
+        remove: ["brand"],
+        refuse: [
+            { path: ["paymentMethodSpecificFields", "storePaymentMethod"], when: "true" },
+            { path: ["paymentMethodSpecificFields", "paymentMethod", "storedPaymentMethodId"], when: "present" },
+            { path: ["paymentMethodSpecificFields", "paymentMethod", "recurringDetailReference"], when: "present" },
+            // The order form's own post on the same path initiates the payment and carries no card.
+            { path: ["paymentInitiateOnly"], when: "true" },
+            // The Drop-in's stored-payment update flow names subscription contracts the card would pay later.
+            { path: ["contracts"], when: "present" }
+        ],
+        amount: null,
+        // Read Oct 23, 2026 (the observe run above). Every selection call answers the whole selection
+        // as JSON: the read, the country and VAT changes, item quantities and the address step (which
+        // wraps it in `selection`). totals.grandTotalPriceAsNumber is what the Drop-in tells its own
+        // wallets to charge, in major units (2497.29 in the run), and currency names the currency. The
+        // card request's URL carries the same selection id, which binds each answer to it. Voucher,
+        // VAT-number and item-removal answers were not seen in the run, so they are not read: any of
+        // those calls after the chosen answer makes it stale.
+        amountSource: {
+            id: "teenage_engineering_selection_totals",
+            origin: "endpoint",
+            format: "json",
+            responses: [
+                { method: "GET", path: "/_api/mw/selections/:selectionId", query: {} },
+                { method: "PUT", path: "/_api/mw/selections/:selectionId", query: {} },
+                { method: "PUT", path: "/_api/mw/selections/:selectionId/address", query: {}, at: ["selection"] },
+                { method: "DELETE", path: "/_api/mw/selections/:selectionId/vat", query: {} },
+                { method: "POST", path: "/_api/mw/selections/:selectionId/items/:itemId/quantity/:quantity", query: {} },
+                { method: "DELETE", path: "/_api/mw/selections/:selectionId/items/:itemId/quantity/:quantity", query: {} }
+            ],
+            total: { path: ["totals", "grandTotalPriceAsNumber"], format: "number" },
+            unit: "major",
+            currency: "USD",
+            currencyPath: ["currency"],
+            bind: [{ placeholder: "selectionId", cardPlaceholder: "selectionId" }],
+            voidedBy: [
+                { method: "POST", path: "/_api/mw/selections/:selectionId/vouchers/:voucherCode", query: {} },
+                { method: "DELETE", path: "/_api/mw/selections/:selectionId/vouchers", query: {} },
+                { method: "POST", path: "/_api/mw/selections/:selectionId/vat/:vatNumber", query: {} },
+                { method: "DELETE", path: "/_api/mw/selections/:selectionId/items/:itemId", query: {} }
+            ],
+            maxAgeMs: 9e5
+        },
+        adyen: {
+            environment: "live",
+            clientKey: "live_FAQ7CUZM7JAO7K6CGXI67KMZ64K35AVH",
+            publicKeySha256: "b99a44120544b609c01ede6041c82b481d23423d7e956355022a5d7f362b5349"
+        }
+    },
+    {
+        // Read Oct 23, 2026, from www.scheels.com's shipped checkout chunk (a Next.js page on commercetools
+        // Frontastic) and a card-free observe run on its guest checkout (every non-GET aborted once the card
+        // form was reached, the placeholder typed into adyen-web 5.5.3's secured fields, Review Order pressed:
+        // the address save before it was aborted too, so the card request was not reached). The Card
+        // component's onSubmit (showPayButton false; the page submits it on Review Order) sets
+        // state.data.paymentMethod.brand from onBrand, then calls the Frontastic action
+        // /cart/setAdyenCreditCard with {payment: {paymentMethod: 'CREDIT_CARD', bin (onBinValue's six
+        // digits, or onFieldValid's issuerBin), lastFour (onFieldValid's endDigits), deviceFingerprint (when
+        // the page has one)}, state: JSON.stringify(state)}. The SDK posts JSON.stringify(payload) to
+        // apihub.scheels.com/frontastic/action/cart/setAdyenCreditCard (its path joiner collapses the
+        // action's leading '/') with content-type application/json and the Frontastic-Session header. So the
+        // four JWEs sit in adyen-web's state, inside the `state` text. bin and lastFour describe the dummy:
+        // the approved card's BIN6 and last four are written there. The body names no amount: the cart the
+        // session holds is charged when Place Order sends cart/checkout, which carries no card. Public key
+        // read from checkoutshopper-live-us.adyen.com on 2026-10-23 (UTC).
+        id: "scheels_frontastic_adyen_card",
+        merchant: "SCHEELS",
+        status: "observe",
+        origins: [{ checkout: "https://www.scheels.com", endpoint: "https://apihub.scheels.com" }],
+        method: "POST",
+        path: "/frontastic/action/cart/setAdyenCreditCard",
+        query: {},
+        requires: [{ path: ["payment", "paymentMethod"], equals: "CREDIT_CARD" }],
+        holder: ["state", TEXT_STEP, "data", "paymentMethod"],
+        fields: {
+            encryptedCardNumber: "encryptedCardNumber",
+            encryptedExpiryMonth: "encryptedExpiryMonth",
+            encryptedExpiryYear: "encryptedExpiryYear",
+            encryptedSecurityCode: "encryptedSecurityCode"
+        },
+        // The page copies onBrand's code (the dummy's) into the state before it is stringified.
+        remove: ["brand"],
+        refuse: [
+            // enableStoreDetails is on for a signed-in shopper only.
+            { path: ["state", TEXT_STEP, "data", "storePaymentMethod"], when: "true" },
+            { path: ["state", TEXT_STEP, "data", "paymentMethod", "storedPaymentMethodId"], when: "present" },
+            { path: ["state", TEXT_STEP, "data", "paymentMethod", "recurringDetailReference"], when: "present" }
+        ],
+        amount: null,
+        // Read Oct 23, 2026 (the observe run above). Every cart action on the checkout page answers the
+        // whole cart, camelCase JSON at the root (addToCart wraps it in `cart`); summary.amountDue is what
+        // the payment step shows as "Amount due" and what is left for the card, in cents (6538 in the run,
+        // the run's total). The cart is the session's, so an answer is tied to the card request by its
+        // page. A gift card or another tender lowers the amount due below the order's gross total and is
+        // refused until a HAR shows which one the charge follows.
+        amountSource: {
+            id: "scheels_cart_amount_due",
+            origin: "endpoint",
+            format: "json",
+            responses: [
+                { method: "POST", path: "/frontastic/action/cart/updateCart", query: {} },
+                { method: "POST", path: "/frontastic/action/cart/setCheckoutDefaults", query: {} },
+                { method: "POST", path: "/frontastic/action/cart/clean", query: {} },
+                { method: "POST", path: "/frontastic/action/cart/addToCart", query: {}, at: ["cart"] },
+                { method: "POST", path: "/frontastic/action/route/addRouteProtection", query: {} },
+                { method: "POST", path: "/frontastic/action/route/removeRouteProtection", query: {} }
+            ],
+            total: { path: ["summary", "amountDue", "centAmount"], format: "number" },
+            unit: "minor",
+            currency: "USD",
+            currencyPath: ["summary", "amountDue", "currencyCode"],
+            bind: [{ samePage: true }],
+            requires: [{ path: ["summary", "amountDue", "centAmount"], equalsPath: ["summary", "grossTotal", "centAmount"] }],
+            refuse: [
+                { path: ["summary", "giftCardTotal", "centAmount"], when: "nonzero" },
+                { path: ["summary", "tenderTotal", "centAmount"], when: "nonzero" }
+            ],
+            // Cart changes whose answers were not seen in the run: any of them after the chosen answer makes it stale.
+            voidedBy: [
+                { method: "POST", path: "/frontastic/action/cart/redeemDiscountCode", query: {} },
+                { method: "POST", path: "/frontastic/action/cart/removeDiscountCode", query: {} },
+                { method: "POST", path: "/frontastic/action/cart/updateItem", query: {} },
+                { method: "POST", path: "/frontastic/action/cart/removeItem", query: {} },
+                { method: "POST", path: "/frontastic/action/cart/setShippingMethod", query: {} },
+                { method: "POST", path: "/frontastic/action/sameDay/setTip", query: {} }
+            ],
+            maxAgeMs: 9e5
+        },
+        facts: [
+            { path: ["payment", "bin"], fact: "bin6" },
+            { path: ["payment", "lastFour"], fact: "last4" }
+        ],
+        adyen: {
+            environment: "live-us",
+            clientKey: "live_7NQ5GGRX7ZD3PJCWBGV6WELTMMA3GBOO",
+            publicKeySha256: "9d6aa672c539f6e76c082beed1fcbe089af526b87c9ea6878ab3671355089065"
+        }
+    },
+    {
+        // Read Oct 23, 2026, from www.buff.com's shipped US checkout (Magento on Hyvä Checkout with
+        // Magewire, Adyen's Hyvä module, adyen-web 5.5.3) and a card-free observe run on its guest checkout
+        // (every non-GET aborted once the card form was reached, the placeholder typed into the secured
+        // fields, nothing pressed). The card renderer keeps adyen-web's state.data from onChange and the
+        // brand code onBrand maps (amex AE, visa VI, mc MC). Place Order calls the adyen_cc component's
+        // placeOrder({stateData, ccType, publicHash: null, extension_attributes}) through Magewire, which
+        // posts JSON.stringify({fingerprint, serverMemo, updates: [{type: 'callMethod', payload: {id,
+        // method: 'placeOrder', params: [that object]}}]}) to
+        // /us/magewire/post/livewire/message/checkout.payment.methods.adyen_cc with content-type
+        // application/json and X-CSRF-TOKEN. The server charges the quote there. ccType describes the
+        // dummy: the approved card's code is written there. The body's own serverMemo, which Magewire signs
+        // with its checksum, carries the component's paymentResponse as JSON text, and its
+        // paymentMethodsExtraDetails.scheme.configuration.amount is the quote's grand total in cents: it
+        // followed the run's total from 8600 to 9342 once shipping and tax were set. A saved card sends a
+        // publicHash and enableStoreDetails is off for a guest. Public key read from
+        // checkoutshopper-live.adyen.com on 2026-10-23 (UTC). Not yet seen on the wire: the card request
+        // itself, which leaves only on Place Order.
+        id: "buff_magewire_adyen_cc",
+        merchant: "Buff",
+        status: "observe",
+        origins: [{ checkout: "https://www.buff.com", endpoint: "https://www.buff.com" }],
+        method: "POST",
+        path: "/us/magewire/post/livewire/message/checkout.payment.methods.adyen_cc",
+        query: {},
+        requires: [
+            { path: ["fingerprint", "name"], equals: "checkout.payment.methods.adyen_cc" },
+            { path: ["updates", 0, "type"], equals: "callMethod" },
+            { path: ["updates", 0, "payload", "method"], equals: "placeOrder" }
+        ],
+        holder: ["updates", 0, "payload", "params", 0, "stateData", "paymentMethod"],
+        fields: {
+            encryptedCardNumber: "encryptedCardNumber",
+            encryptedExpiryMonth: "encryptedExpiryMonth",
+            encryptedExpiryYear: "encryptedExpiryYear",
+            encryptedSecurityCode: "encryptedSecurityCode"
+        },
+        // adyen-web 5.x stamps the dummy's brand into state.data.
+        remove: ["brand"],
+        refuse: [
+            // One call per message: a second update or a second argument is not the reviewed request.
+            { path: ["updates", 1], when: "present" },
+            { path: ["updates", 0, "payload", "params", 1], when: "present" },
+            // A saved card's public hash, or a card kept for later.
+            { path: ["updates", 0, "payload", "params", 0, "publicHash"], when: "true" },
+            { path: ["updates", 0, "payload", "params", 0, "stateData", "storePaymentMethod"], when: "true" },
+            { path: ["updates", 0, "payload", "params", 0, "stateData", "paymentMethod", "storedPaymentMethodId"], when: "present" },
+            { path: ["updates", 0, "payload", "params", 0, "stateData", "paymentMethod", "recurringDetailReference"], when: "present" }
+        ],
+        amount: ["serverMemo", "data", "paymentResponse", TEXT_STEP, "paymentMethodsExtraDetails", "scheme", "configuration", "amount"],
+        facts: [
+            // The renderer's own map (componentHandler.getCcCodeByAltCode); Buff's card list names these three.
+            { path: ["updates", 0, "payload", "params", 0, "ccType"], fact: "brand", map: { visa: "VI", mastercard: "MC", amex: "AE" } }
+        ],
+        adyen: {
+            environment: "live",
+            clientKey: "live_5NIC7BWSNFDX3GBSKL5XCZ4B4YCIWLKP",
+            publicKeySha256: "3f7e1740684cb4964aa8bb7185b9718564fc0957cfc83e096f7bf016d6a7d001"
+        }
+    },
+    {
+        // Read Oct 23, 2026, from www.plein.com's shipped US checkout (Salesforce Commerce Cloud SiteGenesis with Adyen's
+        // int_adyen cartridge, adyen-web 4.9.0) and the press lane's stored copy of the card request the page sent with the
+        // placeholder typed (aborted unsent by the checkout SDK's hold; values sanitized, field names and shape kept). The
+        // card component's onSubmit writes JSON.stringify(state.data) into the hidden field dwfrm_adyPaydata_adyenStateData,
+        // and CONTINUE TO PLACE ORDER submits the billing form: a top-level form post (application/x-www-form-urlencoded) to
+        // /us/billing/. So the four JWEs sit in adyen-web's state, inside that field's JSON text, under paymentMethod
+        // (adyen-web 4.9 writes no brand there; one a later version writes is dropped). Beside the state the page writes
+        // onBrand's code into dwfrm_billing_paymentMethods_creditCard_type and twelve '*' with onFieldValid's last four into
+        // dwfrm_billing_paymentMethods_creditCard_number, both describing the dummy: the approved card's are written there.
+        // The form also carries its csrf_token and its submit button's name twice (dwfrm_billing_save); a repeated field
+        // never reaches a rule. enableStoreDetails is on for a signed-in shopper only. The body names no amount, and the
+        // page's total sits only in its analytics block (tc_vars.order_amount_ati_with_sf), which no reviewed rule reads,
+        // so amountPending holds the profile in observe. Public key read from checkoutshopper-live-us.adyen.com on
+        // 2026-10-23 (UTC).
+        id: "plein_sfcc_billing_form",
+        merchant: "Philipp Plein",
+        status: "observe",
+        origins: [{ checkout: "https://www.plein.com", endpoint: "https://www.plein.com" }],
+        method: "POST",
+        path: "/us/billing/",
+        query: {},
+        encoding: "form",
+        requires: [
+            { path: ["dwfrm_billing_paymentMethods_selectedPaymentMethodID"], equals: "AdyenComponent" },
+            { path: ["brandCode"], equals: "scheme" }
+        ],
+        holder: ["dwfrm_adyPaydata_adyenStateData", TEXT_STEP, "paymentMethod"],
+        fields: {
+            encryptedCardNumber: "encryptedCardNumber",
+            encryptedExpiryMonth: "encryptedExpiryMonth",
+            encryptedExpiryYear: "encryptedExpiryYear",
+            encryptedSecurityCode: "encryptedSecurityCode"
+        },
+        remove: ["brand"],
+        refuse: [
+            { path: ["dwfrm_adyPaydata_adyenStateData", TEXT_STEP, "storePaymentMethod"], when: "true" },
+            { path: ["dwfrm_adyPaydata_adyenStateData", TEXT_STEP, "paymentMethod", "storedPaymentMethodId"], when: "present" },
+            { path: ["dwfrm_adyPaydata_adyenStateData", TEXT_STEP, "paymentMethod", "recurringDetailReference"], when: "present" }
+        ],
+        amount: null,
+        amountPending: "the page names its total only in its analytics block (tc_vars.order_amount_ati_with_sf), which no reviewed rule reads",
+        facts: [
+            // onBrand's adyen-web codes for the networks a US checkout takes.
+            { path: ["dwfrm_billing_paymentMethods_creditCard_type"], fact: "brand", map: { visa: "visa", mastercard: "mc", amex: "amex", discover: "discover" } },
+            { path: ["dwfrm_billing_paymentMethods_creditCard_number"], fact: "masked_last4" }
+        ],
+        adyen: {
+            environment: "live-us",
+            clientKey: "live_P7RRXHAHEVFTLPS3XUD3ML7ZWUEZ6BXN",
+            publicKeySha256: "3e0d4366563b714feb233d12ce98adcef3b606381596e097ca3a8123b9a91d67"
+        }
+    },
+    {
+        // Read Nov 3, 2026, from www.lego.com's shipped US checkout (a Next.js app under /checkout, Apollo GraphQL) and a
+        // card-free run on its guest checkout up to the card form (test contact details, no card typed, nothing pressed;
+        // every non-GET to adyen.com aborted). The checkout's cart answer (CheckoutV2State, paymentMethodsV3.primary) names
+        // CREDIT_CARD_ADYEN with environment 'live' and this client key, and the card form is adyen-web 6's secured fields
+        // (securedFields 6.0.0 on checkoutshopper-live.adyen.com). Place order's handler (chunk 487, the CreditCard submit)
+        // copies encryptedCardNumber, encryptedExpiryMonth, encryptedExpiryYear, encryptedSecurityCode, type and holderName
+        // out of adyen-web's state.data.paymentMethod, with no brand, and sends the Apollo mutation AddAdyenPayment with
+        // variables {input: {paymentReference: <the cart's orderNumber>, telephoneNumber, browserInfo, origin, paymentMethod,
+        // returnUrl, storePaymentMethod, tracking}}. Apollo posts {operationName, variables, query} as JSON to the gateway
+        // (www.lego.com/checkout/api/graphql), whose link adds the operation name to the path: every checkout operation in
+        // the run went to /checkout/api/graphql/<operationName>. So the card request is Lego's own server, Adyen's Advanced
+        // flow. A saved card goes as AddAdyenSavedCardPaymentV2, a gift card as AddGiftCardPaymentV2Mutation, each on its
+        // own path. The body names no amount. Public key read from checkoutshopper-live.adyen.com on 2026-11-03 (UTC). Not
+        // yet seen on the wire: the card request itself, which leaves only on Place order.
+        // Enabled on Nov 4, 2026 under D1, so the Vault's bundled copy of this table carries it at the next Vault release. No
+        // company is admitted yet: Agentcard's proof company joins through a flip in backend merchant-profile-orgs.ts after that
+        // release. Felipe's approval of this change is his D1 decision for LEGO, and Karen's its PCI review.
+        // No afterPayment reader yet: nobody has seen what LEGO answers after a placed order, so the charge is not compared with
+        // the approved amount after payment and merchantChargeVerdict has nothing to read (Greptile on this change). The amount
+        // is checked before payment (amountSource below). Until a reviewed afterPayment lands, built from the response the first
+        // live run captures, Agentcard's proof company makes no purchase LEGO's Adyen approves: its runs use a card Adyen declines.
+        id: "lego_checkout_add_adyen_payment",
+        merchant: "LEGO",
+        status: "enabled",
+        origins: [{ checkout: "https://www.lego.com", endpoint: "https://www.lego.com" }],
+        method: "POST",
+        path: "/checkout/api/graphql/AddAdyenPayment",
+        query: {},
+        requires: [
+            { path: ["operationName"], equals: "AddAdyenPayment" },
+            { path: ["variables", "input", "paymentMethod", "type"], equals: "scheme" }
+        ],
+        holder: ["variables", "input", "paymentMethod"],
+        fields: {
+            encryptedCardNumber: "encryptedCardNumber",
+            encryptedExpiryMonth: "encryptedExpiryMonth",
+            encryptedExpiryYear: "encryptedExpiryYear",
+            encryptedSecurityCode: "encryptedSecurityCode"
+        },
+        // The page copies no brand out of adyen-web's state.
+        remove: [],
+        refuse: [
+            { path: ["variables", "input", "storePaymentMethod"], when: "true" },
+            { path: ["variables", "input", "paymentMethod", "storedPaymentMethodId"], when: "present" },
+            { path: ["variables", "input", "paymentMethod", "recurringDetailReference"], when: "present" }
+        ],
+        amount: null,
+        // Read Nov 3, 2026 (the run above). The checkout's cart answers carry the whole cart: CheckoutV2State at
+        // data.me.cart, the address step at data.updateCartAddresses and the shipping step at data.setCartShippingMethod.
+        // remainingTotalToPay is what is left for the card, in cents (1191 in the run, the page's Order Total $11.91), and
+        // orderNumber is the paymentReference the card request sends, which ties each answer to it. A gift card already
+        // applied shows in payments and lowers what is left below the order's total, so a cart with one is refused. Cart
+        // changes whose answers were not seen in the run make the chosen answer stale.
+        amountSource: {
+            id: "lego_cart_remaining_total",
+            origin: "endpoint",
+            format: "json",
+            responses: [
+                { method: "POST", path: "/checkout/api/graphql/CheckoutV2State", query: {}, at: ["data", "me", "cart"] },
+                { method: "POST", path: "/checkout/api/graphql/SetAddressMutation", query: {}, at: ["data", "updateCartAddresses"] },
+                { method: "POST", path: "/checkout/api/graphql/SetShippingMethodV2Mutation", query: {}, at: ["data", "setCartShippingMethod"] }
+            ],
+            total: { path: ["remainingTotalToPay", "centAmount"], format: "number" },
+            unit: "minor",
+            currency: "USD",
+            currencyPath: ["remainingTotalToPay", "currencyCode"],
+            bind: [{ source: ["orderNumber"], card: ["variables", "input", "paymentReference"] }],
+            refuse: [
+                { path: ["payments"], when: "nonEmpty" },
+                // A GraphQL error result is not a total, even beside partial data.
+                { path: ["errors"], when: "present", root: true }
+            ],
+            voidedBy: [
+                { method: "POST", path: "/checkout/api/graphql/AddGiftCardPaymentV2Mutation", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/AddGiftCardOnlyPayment", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/RemoveGiftCardPaymentMutations", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/AddVipLineItemCheckout", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/EditVipLineItemCheckout", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/RemoveVipPointsLineItemCheckout", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/SetShippingMethodOnlyMutation", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/SetAddressMutationWithoutEmail", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/SetAddressesMutationV2", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/saveCollectionPointMutation", query: {} }
+            ],
+            maxAgeMs: 9e5
+        },
+        adyen: {
+            environment: "live",
+            clientKey: "live_P34BZ2Q6ANHNHAUEKOFOX3IMHQHZ75ES",
+            publicKeySha256: "5659f43faa157b82b45844fdf35382a8b83b7bb24662b5e0fbcca15fd120bcc2"
+        }
     }
 ]);
 function adyenKeyHost(environment) {
@@ -1617,23 +2074,80 @@ function declaredEndpointRefusal(endpoint) {
         return `${url.hostname} belongs to a merchant Agentcard reviewed, so it cannot be declared`;
     return null;
 }
-function merchantBodyRefusal(profile, body) {
-    const p = merchantProfileRecognizerById(typeof profile === "string" ? profile : profile?.id);
-    if (!p)
-        throw new Error("Refusing to pay: unknown merchant profile.");
+function textRefusal(p, parsed) {
+    const amount = p.amount;
+    const amountPaths = Array.isArray(amount) ? [amount] : isPlainObject(amount) ? [amount.value, amount.currency] : [];
+    const paths = [p.holder, ...p.requires.map((rule) => rule.path), ...p.refuse.map((rule) => rule.path), ...amountPaths].filter(Array.isArray);
+    for (const path of paths) {
+        for (const [k, step] of path.entries()) {
+            if (!isTextStep(step))
+                continue;
+            const before = path.slice(0, k);
+            if (valuesIgnoringCase(parsed, before).some((value) => valuesIgnoringCase(value, [TEXT_STEP]).length === 0)) {
+                return `the paused body's ${describePath(before)} is not JSON text written the way JSON.stringify or PHP's json_encode writes it, so ${p.merchant}'s rules cannot read it`;
+            }
+        }
+    }
+    return null;
+}
+function formBodyView(body) {
+    if (typeof body !== "string" || body === "")
+        return void 0;
+    let params;
+    try {
+        params = new URLSearchParams(body);
+    }
+    catch {
+        return void 0;
+    }
+    if (params.toString() !== body)
+        return void 0;
+    const view = /* @__PURE__ */ Object.create(null);
+    for (const [name, value] of params) {
+        if (!Object.prototype.hasOwnProperty.call(view, name))
+            view[name] = value;
+        else
+            view[name] = Array.isArray(view[name]) ? [...view[name], value] : [view[name], value];
+    }
+    return view;
+}
+function readProfileBody(p, body) {
+    if (p.encoding === "form") {
+        const view = formBodyView(body);
+        return view === void 0 ? { refusal: "the paused body is not a form written the way a browser writes it, so its rules cannot be read" } : { parsed: view };
+    }
     let parsed;
     try {
         parsed = typeof body === "string" ? JSON.parse(body) : void 0;
     }
     catch {
-        return "the paused body is not JSON";
+        return { refusal: "the paused body is not JSON" };
     }
     if (!isPlainObject(parsed))
-        return "the paused body is not a JSON object";
+        return { refusal: "the paused body is not a JSON object" };
     if (!roundTrips(parsed, body))
-        return "the paused body does not round-trip through JSON, so its rules cannot be read";
+        return { refusal: "the paused body does not round-trip through JSON, so its rules cannot be read" };
+    return { parsed };
+}
+function merchantProfileBody(profile, body) {
+    const p = merchantProfileRecognizerById(typeof profile === "string" ? profile : profile?.id);
+    if (!p)
+        throw new Error("Refusing to pay: unknown merchant profile.");
+    return readProfileBody(p, body).parsed;
+}
+function merchantBodyRefusal(profile, body) {
+    const p = merchantProfileRecognizerById(typeof profile === "string" ? profile : profile?.id);
+    if (!p)
+        throw new Error("Refusing to pay: unknown merchant profile.");
+    const read = readProfileBody(p, body);
+    if (read.refusal)
+        return read.refusal;
+    const parsed = read.parsed;
+    const unreadText = textRefusal(p, parsed);
+    if (unreadText)
+        return unreadText;
     for (const rule of p.requires) {
-        const at = jsonAt(parsed, rule.path);
+        const at = profileAt(parsed, rule.path);
         if (!at.found || at.value !== rule.equals || valuesIgnoringCase(parsed, rule.path).some((value) => value !== rule.equals)) {
             return `the paused body is not ${p.merchant}'s card request: ${describePath(rule.path)} is not ${JSON.stringify(rule.equals)}`;
         }
@@ -1646,40 +2160,6 @@ function merchantBodyRefusal(profile, body) {
     }
     return null;
 }
-// src/adyen-jwe.js
-var BASE64URL = /^[A-Za-z0-9_-]+$/;
-var ADYEN_WEB_JWE_FORMATS = /* @__PURE__ */ Object.freeze([
-    /* @__PURE__ */ Object.freeze({ alg: "RSA-OAEP-256", enc: "A256GCM", iv: 16, tag: 22 }),
-    /* @__PURE__ */ Object.freeze({ alg: "RSA-OAEP", enc: "A256CBC-HS512", iv: 22, tag: 43 })
-]);
-var ADYEN_WEB_CIPHERTEXT_MAX = 8192;
-var ADYEN_WEB_HEADER_MAX = 128;
-function adyenWebJweHeader(segment) {
-    if (!BASE64URL.test(segment) || segment.length > ADYEN_WEB_HEADER_MAX)
-        return null;
-    let parsed;
-    try {
-        parsed = JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(segment.replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0))));
-    }
-    catch {
-        return null;
-    }
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-        return null;
-    return Object.keys(parsed).sort().join(",") === "alg,enc,version" && parsed.version === "1" ? parsed : null;
-}
-function isAdyenWebJweCompact(s) {
-    if (typeof s !== "string" || s.length > ADYEN_WEB_HEADER_MAX + 342 + 22 + ADYEN_WEB_CIPHERTEXT_MAX + 43 + 4)
-        return false;
-    const parts = s.split(".");
-    if (parts.length !== 5 || !parts.every((p) => p.length > 0 && BASE64URL.test(p)))
-        return false;
-    const [header, encryptedKey, iv, ciphertext, tag] = parts;
-    if (encryptedKey.length !== 342 || ciphertext.length > ADYEN_WEB_CIPHERTEXT_MAX)
-        return false;
-    const parsed = adyenWebJweHeader(header);
-    return parsed !== null && ADYEN_WEB_JWE_FORMATS.some((form) => parsed.alg === form.alg && parsed.enc === form.enc && iv.length === form.iv && tag.length === form.tag);
-}
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,
@@ -1811,6 +2291,40 @@ function sha256Hex(input) {
     }
     return Array.from(H, (word) => word.toString(16).padStart(8, "0")).join("");
 }
+// src/adyen-jwe.js
+var BASE64URL = /^[A-Za-z0-9_-]+$/;
+var ADYEN_WEB_JWE_FORMATS = /* @__PURE__ */ Object.freeze([
+    /* @__PURE__ */ Object.freeze({ alg: "RSA-OAEP-256", enc: "A256GCM", iv: 16, tag: 22 }),
+    /* @__PURE__ */ Object.freeze({ alg: "RSA-OAEP", enc: "A256CBC-HS512", iv: 22, tag: 43 })
+]);
+var ADYEN_WEB_CIPHERTEXT_MAX = 8192;
+var ADYEN_WEB_HEADER_MAX = 128;
+function adyenWebJweHeader(segment) {
+    if (!BASE64URL.test(segment) || segment.length > ADYEN_WEB_HEADER_MAX)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(segment.replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0))));
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return null;
+    return Object.keys(parsed).sort().join(",") === "alg,enc,version" && parsed.version === "1" ? parsed : null;
+}
+function isAdyenWebJweCompact(s) {
+    if (typeof s !== "string" || s.length > ADYEN_WEB_HEADER_MAX + 342 + 22 + ADYEN_WEB_CIPHERTEXT_MAX + 43 + 4)
+        return false;
+    const parts = s.split(".");
+    if (parts.length !== 5 || !parts.every((p) => p.length > 0 && BASE64URL.test(p)))
+        return false;
+    const [header, encryptedKey, iv, ciphertext, tag] = parts;
+    if (encryptedKey.length !== 342 || ciphertext.length > ADYEN_WEB_CIPHERTEXT_MAX)
+        return false;
+    const parsed = adyenWebJweHeader(header);
+    return parsed !== null && ADYEN_WEB_JWE_FORMATS.some((form) => parsed.alg === form.alg && parsed.enc === form.enc && iv.length === form.iv && tag.length === form.tag);
+}
 // src/adyen-merchant-hosted.js
 function matchProfileEndpoint(profile, rawUrl, method, opts) {
     const p = trustedMerchantProfile(profile);
@@ -1949,7 +2463,7 @@ var PASS = /* @__PURE__ */ Object.freeze({ verdict: "pass" });
 var PAUSE = /* @__PURE__ */ Object.freeze({ verdict: "pause" });
 var abort = (reason) => Object.freeze({ verdict: "abort", reason });
 function holderRefusal(profile, parsed) {
-    const holder = jsonAt(parsed, profile.holder);
+    const holder = profileAt(parsed, profile.holder);
     if (!holder.found || !isPlainObject(holder.value)) {
         return `the paused body carries no card object where ${profile.merchant}'s card request holds it`;
     }
@@ -1967,6 +2481,8 @@ function holderRefusal(profile, parsed) {
 function amountRefusal(profile, parsed) {
     const priced = isPlainObject(profile.amountSource);
     if (profile.amount === null || profile.amount === void 0) {
+        if (!priced && typeof profile.amountPending === "string" && profile.amountPending !== "")
+            return null;
         return priced ? null : `${profile.merchant}'s card request names no amount, so it cannot be checked against the amount the cardholder approves`;
     }
     if (!Array.isArray(profile.amount)) {
@@ -1984,7 +2500,7 @@ function amountRefusal(profile, parsed) {
         }
         return `the amount where ${profile.merchant}'s card request holds it is not the amount Agentcard reviewed, so it cannot be checked`;
     }
-    const at = jsonAt(parsed, profile.amount);
+    const at = profileAt(parsed, profile.amount);
     if (!at.found) {
         return priced ? null : `the paused body names no amount where ${profile.merchant}'s card request holds it, so it cannot be checked against the amount the cardholder approves`;
     }
@@ -2002,7 +2518,7 @@ function classifyMerchantBody(profileId, body) {
     const refusal = merchantBodyRefusal(profile.id, body);
     if (refusal)
         return abort(refusal);
-    const parsed = JSON.parse(body);
+    const parsed = merchantProfileBody(profile.id, body);
     const card = holderRefusal(profile, parsed) ?? amountRefusal(profile, parsed);
     return card ? abort(card) : PAUSE;
 }
@@ -2098,7 +2614,22 @@ function merchantBodyKeyPathSha256(body) {
         parsed = JSON.parse(body);
     }
     catch {
-        return null;
+        parsed = void 0;
+    }
+    if (parsed === void 0) {
+        const view = formBodyView(body);
+        if (view === void 0)
+            return null;
+        parsed = Object.fromEntries(Object.entries(view).map(([name, value]) => {
+            if (typeof value !== "string" || !/^[[{]/.test(value))
+                return [name, value];
+            try {
+                return [name, JSON.parse(value)];
+            }
+            catch {
+                return [name, value];
+            }
+        }));
     }
     const paths = /* @__PURE__ */ new Set();
     keyPaths(parsed, paths);