@agent-cards/sdk 0.23.3 → 0.23.4

package/CHANGELOG.md

@@ -10,6 +10,8 @@
 
 - Recognize Target Optical's card request as its checkout sends it today: a JSON `PUT` to `/wcs/resources/store/12001/cart/@self/addPayment` with the page's `nocache` query, the total in `piAmount` with five decimals (`"49.42000"`). The profile described the form post Target Optical's older checkout sent, which no request matches now, so the adapters let the dummy card reach Target Optical. The profile stays in observe: both adapters now pause that request and refuse it as `unsupported_checkout` before any authorization, let the saved-card body to the same URL through untouched, and abort the card save a signed-in shopper's page sends to `/wcs/resources/store/12001/mypayments` in every status. They also abort, in every status, a post to `/AjaxOrderChangeServicePIAddTO`, the form endpoint the older checkout used, which they refused before and which the storefront still declares in a script it serves, so moving the profile to the `PUT` leaves no path where the dummy card reaches Target Optical. `attachToPlaywright` routes a reviewed card endpoint's request by every method the profiles name; it asked only for `POST`, so a `PUT` card request or resend never reached its gates. A card endpoint create names the profile's own method in `request.method`; an API that reads every card endpoint request as a `POST` refuses a `PUT` create with `invalid_request`, so nothing is charged. TypeScript: `CardEndpointProfile.method` can be `PUT`.
 
+- Pay Cinemark and Dick's Sporting Goods' own storefront, two reviewed Adyen merchants that take the card on their own server. Both profiles, `cinemark_initiate` and `dsg_paygate_v2`, ship `enabled`, and the API serves them `enabled` only to a client of a company Agentcard turned them on for. For every other client the adapters keep pausing and aborting their card requests as `merchant_profile_observed`, as before. A payment there needs a preparation for the profile and the cardholder's approval in the Vault, and Autopilot never pays one. The create carries the merchant's own checkout total as your agent's browser read it, and the API refuses a payment whose amount is not that total. Dick's paygate at Golf Galaxy, Public Lands and Going Going Gone moves to its own profile, `dsg_other_stores_paygate_v2`, which ships in `observe`, so the adapters abort those card requests as before. Matching API and Vault releases are required.
+
 - Stop the card fields adyen-web 5 encrypts at a reviewed Adyen merchant profile. adyen-web 5 seals each field as an RSA-OAEP / A256CBC-HS512 JWE, where adyen-web 6 writes RSA-OAEP-256 / A256GCM, and the SDK read only adyen-web 6's form. So the card requests of Cathay Pacific's payment page and Dunelm's legacy checkout, and Cathay's charge request after its signing step, reached the merchant with the agent's dummy card. The adapters now read both forms as a card. Both profiles ship in `observe`, so the adapters abort each of these requests before it leaves the browser and report it as `merchant_profile_observed`. The Vault writes only adyen-web 6's form, so the API refuses a create for a card request in adyen-web 5's form with `cse_template_unsupported`, and nothing is charged.
 
 - Abort the requests in which IHG's pay page sends the typed card outside its reviewed card request, in every status, as `card_endpoint_refused` with reason `card_resend`. The page posts the same booking to IHG's enrollment service while its pre-ticked "Enroll for free" box stays ticked, posts it on other paths for more than one room, a travel agent or Business Rewards, and at a hotel that asks for 3-D Secure first posts the number to two 3-D Secure calls. The SDK let each of these reach IHG with the agent's dummy card. A booking with the box unticked reaches IHG's reviewed card request, which the adapters refuse as before while IHG is in `observe`.

package/README.md

@@ -255,7 +255,7 @@ Coverage is specific to the processor request format, merchant setup, browser tr
 | Mercado Pago | Card tokenization and prepared checkout are implemented. Guest Checkout Pro in Mexico also corrects the issuer for one native card association when the selected card has the same brand and type. One live MXN 40 Lotería Chida purchase with published SDK 0.10.0 completed automatically through Pay; the merchant confirmed paid status and PDF fulfillment. The historical SDK result remains unknown because the private receipt adapter rejected a relative download URL; a separate read with the corrected adapter confirms that same paid receipt. Independent processor capture/settlement and other country or integration paths remain unverified. |
 | VGS Collect (Very Good Security; Wolt) | not supported: VGS's proxy aliases only submissions from its own iframe, so a replay from the cardholder's device is refused by the merchant (verified on Wolt, 2026-09-03). Not recognized, so the agent's browser is not paused there |
 | PayPal Hosted Fields (the legacy card fields of PayPal's JS SDK; Planet Golf UK) | not supported: no Agentcard payment takes over the card these fields send to `cors.api.paypal.com`. The SDK fails that request for every company, so PayPal's payment confirm never receives the dummy card, and the controller reads `unsupported` with reason `unsupported_paypal_hosted_fields` and holds the attachment until you attach again; a PayPal wallet payment continues untouched |
-| Adyen | supported (mode `cse`): the vault encrypts the card for Adyen on the cardholder's device and your browser sends it. Sessions flow: the paused request is `/checkoutshopper/v1/sessions/{id}/payments` on Adyen's own hosts. A merchant that posts the encrypted fields to its own server pauses only when Agentcard reviewed it as a merchant profile (Dunelm and Cinemark so far); both profiles are in `observe`, so their card requests are reported and aborted and nothing pays there yet (see "Adyen merchants that take the card on their own server"). Without a preparation, approval starts at Pay and must land before Adyen Web's own request timeout (observed at 60 seconds on Adyen Web 6.41 and 6.44; not enforced by the SDK); `prepare({ psp: 'adyen' })` moves the approval before Pay |
+| Adyen | supported (mode `cse`): the vault encrypts the card for Adyen on the cardholder's device and your browser sends it. Sessions flow: the paused request is `/checkoutshopper/v1/sessions/{id}/payments` on Adyen's own hosts. A merchant that posts the encrypted fields to its own server pauses only when Agentcard reviewed it as a merchant profile. Cinemark and Dick's Sporting Goods' own storefront take payments for a company Agentcard turned them on for; every other reviewed merchant is in `observe`, so its card requests are reported and aborted and nothing pays there yet (see "Adyen merchants that take the card on their own server"). Without a preparation, approval starts at Pay and must land before Adyen Web's own request timeout (observed at 60 seconds on Adyen Web 6.41 and 6.44; not enforced by the SDK); `prepare({ psp: 'adyen' })` moves the approval before Pay |
 | ACI Worldwide COPYandPAY (Halfords) | dark launch: served only after `syncRegistry()` and only for an org Agentcard enabled; prepared checkout only. The card-number request is replayed from the cardholder's device, the page's own CVC and expiry requests are answered locally, and `/payment` continues once. See [Pay an ACI COPYandPAY checkout](#pay-an-aci-copyandpay-checkout) |
 | Tranzila | supported (mode `hosted_form`): the cardholder finishes on Tranzila's own page; the paused form navigation resolves to a synthetic page, and you poll the merchant's order state |
 | Fiserv Commerce Hub | implemented (mode `cse`, prepared checkout only) and off until Agentcard turns it on for your company: the card frame's card capture on `connect.fiservapis.com` (or `connect-cert.fiservapis.com` in the sandbox), with the approved card encrypted on the cardholder's device under a key Agentcard reviewed for the merchant. A merchant whose frame posts to Fiserv's `payment-link` endpoint is not recognized. No live merchant purchase is verified yet |
@@ -1252,7 +1252,7 @@ Some Adyen merchants have adyen-web encrypt the card into four fields and post t
 
 - A request that carries no encrypted card (a basket query, a preflight) continues as before.
 - A body the browser did not hand over (a blob or a file, which neither adapter can read) is not proven card-free, so any request but a `GET`, `HEAD` or `OPTIONS` that carries one is treated as a card request the profile cannot finish. Playwright reports a missing body the same way, so an empty body is treated alike in both adapters.
-- A profile in `observe` never pays. Its card request is aborted before it reaches the merchant, and the adapters report `merchant_profile_observed` with the profile, the templated URL, the verdict and `keyPathSha256`, the SHA-256 of the body's sorted key paths (never a value; `null` for a body that was not read), then `unsupported_checkout`. The controller reads `unsupported` with reason `merchant_profile_observe`, and no authorization exists. Both reviewed profiles, `dunelm_was_graphql` and `cinemark_initiate`, ship in `observe`.
+- A profile in `observe` never pays. Its card request is aborted before it reaches the merchant, and the adapters report `merchant_profile_observed` with the profile, the templated URL, the verdict and `keyPathSha256`, the SHA-256 of the body's sorted key paths (never a value; `null` for a body that was not read), then `unsupported_checkout`. The controller reads `unsupported` with reason `merchant_profile_observe`, and no authorization exists. `cinemark_initiate` and `dsg_paygate_v2` (Dick's Sporting Goods' own storefront) ship `enabled`, and the API serves them `enabled` only to a client of a company Agentcard turned them on for. Every other reviewed profile ships in `observe`, `dunelm_was_graphql` and `dsg_other_stores_paygate_v2` (Dick's paygate at Golf Galaxy, Public Lands and Going Going Gone) among them.
 - A card request the profile cannot finish (storing the card, a stored card, another operation, three fields instead of four, a sibling endpoint, an unreadable body) is aborted with `unsupported_checkout` and the reason, and reads `unsupported` with reason `merchant_request_unsupported`.
 - The profile's own card request, once Agentcard enables the profile for your client and this build, pays only through a preparation for that profile. Without one it is aborted before any pause, prompt or authorization: the adapters report `blocked` with `preparation_required`, the controller reads `failed` with that reason, and `prepare()` is refused on that attachment, as after any first card request. Create a new attachment and prepare before Pay.
 
@@ -1266,7 +1266,7 @@ After hand-off, a `5xx` final answer (after any redirect), a network failure, or
 
 #### Testing against your own Adyen TEST account
 
-A test-mode client can run the same checkout against its own server and its own Adyen TEST account, before any reviewed profile is enabled. Declare your endpoint on the client, before any attach, as taking the card request of a profile this build reviewed:
+A test-mode client can run the same checkout against its own server and its own Adyen TEST account, whether or not Agentcard has enabled the reviewed profile. Declare your endpoint on the client, before any attach, as taking the card request of a profile this build reviewed:
 
 ```ts
 const vault = new VaultClient({ clientId, clientSecret, sandboxMerchants: [

package/dist/adyen-merchant-hosted.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: c979802cf1a5aa95eedd5dd00949cd56c5c478ca3c637b3232b69597cc62d4a4
+// artifact-sha256: 4790fdfc656acbda50ddf8471507933ddd4938f4c5b351ec096a9549a7c8c257
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -1086,6 +1086,118 @@ function selectMerchantExchanges(profile, stageName, input) {
     return { ok: true, responses: newestMerchantExchanges(kept) };
 }
 // src/merchant-profiles.js
+var DSG_PAYGATE_V2 = /* @__PURE__ */ deepFreeze({
+    method: "POST",
+    path: "/prod/api/paygate/v2/authorization",
+    query: {},
+    // The page sends true for every checkout its translator read, the only checkouts
+    // the amount source below maps; a legacy checkout is not this card request.
+    requires: [{ path: ["isModernOrder"], equals: true }],
+    holder: ["tenders", "encryptedCardTenders", 0],
+    fields: {
+        encryptedCardNumber: "cardNumber",
+        encryptedExpiryMonth: "expirationMonth",
+        encryptedExpiryYear: "expirationYear",
+        encryptedSecurityCode: "cvv"
+    },
+    // cardType and vinBalue describe the dummy the agent typed: the facts below
+    // write the approved card's instead, so nothing is removed.
+    remove: [],
+    refuse: [
+        { path: ["tenders", "encryptedCardTenders", 0, "saveForLater"], when: "true" },
+        // A saved card, or a second card tender the Vault never encrypted.
+        { path: ["tenders", "savedCardTender"], when: "present" },
+        { path: ["tenders", "encryptedCardTenders", 1], when: "present" },
+        // A gift card pays part of the order, so the card pays less than the total.
+        { path: ["tenders", "giftCardTenders"], when: "present" }
+    ],
+    amount: null,
+    // Read Sep 25, 2026 (research amount_source/dickssportinggoods). Every checkout call
+    // on the checkout page answers the whole checkout, camelCase on the wire: the page
+    // load's PATCH (or the create), then every address, shipping, promotion, gift card,
+    // tip and ScoreCard change. pricing.totalRemaining is what the card pays, a string
+    // with exactly two decimals ("123.45"; the page itself drops the dot for minor
+    // units). transactionReference is the checkout key, in the body and the URL. After
+    // payment the order submit and the confirmation read return the placed checkout.
+    amountSource: {
+        id: "dsg_checkout_pricing",
+        origin: "checkout",
+        format: "json",
+        responses: [
+            { method: "PATCH", path: "/api/v1/checkouts/:checkoutKey", query: {} },
+            { method: "POST", path: "/api/v1/checkouts", query: {} },
+            { method: "POST", path: "/api/v1/checkouts/:checkoutKey/addresses", queries: [{}, { type: "billing" }, { type: "shipping" }] },
+            { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/shipping/selected/groups/:groupNumber/mode", query: {} },
+            { method: "PUT", path: "/api/v2/checkouts/:checkoutKey/promotion/cart", query: {} },
+            { method: "DELETE", path: "/api/v2/checkouts/:checkoutKey/promotion/cart", query: {} },
+            { method: "POST", path: "/api/v1/checkouts/:checkoutKey/gift-cards", query: {} },
+            { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/gift-cards/:giftCardIndex", query: {} },
+            { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/tip", query: {} },
+            { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/scorecard", query: {} },
+            { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/scorecard", query: {} },
+            { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/v2/gifts", query: {} }
+        ],
+        total: { path: ["pricing", "totalRemaining"], format: "decimal2" },
+        unit: "major",
+        currency: "USD",
+        currencyPath: ["pricing", "currency"],
+        bind: [
+            { source: ["checkoutKey"], card: ["transactionReference"] },
+            { placeholder: "checkoutKey", card: ["transactionReference"] }
+        ],
+        // The order total and the card's share are the same text. Anything that lowers the
+        // share below the total (a gift card, ScoreCard rewards) or lands in only one of them
+        // (a tip, a donation) is refused until a HAR shows which one the charge follows, so
+        // the approved amount and the placed checkout's total read after payment agree.
+        requires: [{ path: ["pricing", "total"], equalsPath: ["pricing", "totalRemaining"] }],
+        refuse: [
+            // A placed checkout is not the one being paid.
+            { path: ["orderPlacedTime"], when: "true" },
+            // Gift cards and a checkout with no address yet (tax not estimated) wait for a HAR.
+            { path: ["payment", "giftCards"], when: "nonEmpty" },
+            { path: ["addresses"], when: "empty" }
+        ],
+        maxAgeMs: 9e5,
+        afterPayment: {
+            origin: "checkout",
+            format: "json",
+            responses: [
+                { method: "POST", path: "/api/v1/checkouts/:checkoutKey", query: {} },
+                { method: "GET", path: "/api/v1/checkouts/submitted/:checkoutKey", query: {} }
+            ],
+            // The order total, which the requires rule above held equal to the card's share
+            // before payment. totalRemaining is not read here: after placement it can drop to
+            // what is still unpaid, which would hide a higher charge.
+            total: { path: ["pricing", "total"], format: "decimal2" },
+            unit: "major",
+            currency: "USD",
+            currencyPath: ["pricing", "currency"],
+            bind: [
+                { source: ["checkoutKey"], card: ["transactionReference"] },
+                { placeholder: "checkoutKey", card: ["transactionReference"] }
+            ],
+            refuse: [{ path: ["orderPlacedTime"], when: "unset" }]
+        }
+    },
+    facts: [
+        // adyen-web's brand codes, the ones the page's supported list names; Dick's own
+        // private-label (plcc, comc) cards have no Agentcard brand and are refused.
+        {
+            path: ["tenders", "encryptedCardTenders", 0, "cardType"],
+            fact: "brand",
+            map: { visa: "visa", mastercard: "mc", amex: "amex", discover: "discover", diners: "diners", jcb: "jcb" }
+        },
+        { path: ["tenders", "encryptedCardTenders", 0, "vinBalue"], fact: "bin6" }
+    ],
+    adyen: {
+        environment: "live",
+        clientKey: "live_YJLFKT47JJG2RI7QIYX6HTKKDEDOEGOH",
+        publicKeySha256: "da33611149dff3ab715be8671c0550bb8aec6112983b2473db9ee7afb829c110"
+    }
+});
+function dsgPaygateProfile(own) {
+    return { ...own, ...DSG_PAYGATE_V2 };
+}
 var MERCHANT_HOSTED_PROFILES = /* @__PURE__ */ deepFreeze([
     {
         // Read Sep 23, 2026. assets.dunelm.com checkout-page bundle: submitPayment
@@ -1181,10 +1293,13 @@ var MERCHANT_HOSTED_PROFILES = /* @__PURE__ */ deepFreeze([
         // client key from the three securedFields iframes on
         // checkoutshopper-live-us.adyen.com (adyen-web 6.x). The request body itself
         // was not captured: the guest email gate stopped the run before Pay. Public
-        // key read from checkoutshopper-live-us.adyen.com on 2026-09-25 (UTC).
+        // key read from checkoutshopper-live-us.adyen.com on 2026-09-25 (UTC). Enabled
+        // Oct 7, 2026 under D1 (amountSource, above): live checks on Sep 30 and Oct 6
+        // matched its key pin, its card request as the page's script builds it, and its
+        // checkout total.
         id: "cinemark_initiate",
         merchant: "Cinemark",
-        status: "observe",
+        status: "enabled",
         origins: [{ checkout: "https://www.cinemark.com", endpoint: "https://www.cinemark.com" }],
         method: "POST",
         path: "/api/adyen/initiatePayment",
@@ -1257,137 +1372,29 @@ var MERCHANT_HOSTED_PROFILES = /* @__PURE__ */ deepFreeze([
             publicKeySha256: "9dd5ef549c7454d60ca970ff76c8f4cac36d79f2961e59eca9116791e86cbcc5"
         }
     },
-    {
-        // Read Sep 23, 2026. payments.dickssportinggoods.com/library/dppjs/index-v2.js
-        // (adyen-web 6.39.0): Dd() builds tenders.encryptedCardTenders[0] from the Card
-        // component's four JWEs as cardNumber, expirationMonth, expirationYear and cvv,
-        // beside cardType (adyen-web's first detected brand), saveForLater (the save-card
-        // box) and vinBalue (the six digits onBinValue reports). The page posts it with
-        // transactionReference, customer.device and any giftCardTenders to
-        // <payments host>/prod/api/paygate/v2/authorization, the host picked from the
-        // page's own (Dick's, Golf Galaxy, Public Lands, Going Going Gone). The same slot
-        // carries Afterpay, CashApp and Affirm tenders with literal strings where the JWEs
-        // go, and a saved card goes to tenders.savedCardTender instead. The body names no
-        // amount: the paygate charges the cart it holds for transactionReference.
-        // mountCCForm names the client key and environment 'live'. Public key read from
-        // checkoutshopper-live.adyen.com on 2026-09-25 (UTC).
+    /* @__PURE__ */ dsgPaygateProfile({
+        // Dick's own storefront, the one live checks read on Sep 30 and Oct 6, 2026: its key
+        // pin, its card request as the page's code builds it, its card facts and its checkout
+        // pricing matched DSG_PAYGATE_V2. Enabled Oct 7, 2026 under D1 (amountSource, above).
         id: "dsg_paygate_v2",
         merchant: "Dick's Sporting Goods",
+        status: "enabled",
+        origins: [
+            { checkout: "https://www.dickssportinggoods.com", endpoint: "https://payments.dickssportinggoods.com" }
+        ]
+    }),
+    /* @__PURE__ */ dsgPaygateProfile({
+        // The same paygate on the three other storefronts its page names. No live check has
+        // read them, so their card requests stay paused and aborted in observe.
+        id: "dsg_other_stores_paygate_v2",
+        merchant: "Golf Galaxy, Public Lands and Going Going Gone",
         status: "observe",
         origins: [
-            { checkout: "https://www.dickssportinggoods.com", endpoint: "https://payments.dickssportinggoods.com" },
             { checkout: "https://www.golfgalaxy.com", endpoint: "https://payments.golfgalaxy.com" },
             { checkout: "https://www.publiclands.com", endpoint: "https://payments.publiclands.com" },
             { checkout: "https://www.goinggoinggone.com", endpoint: "https://payments.goinggoinggone.com" }
-        ],
-        method: "POST",
-        path: "/prod/api/paygate/v2/authorization",
-        query: {},
-        // The page sends true for every checkout its translator read, the only checkouts
-        // the amount source below maps; a legacy checkout is not this card request.
-        requires: [{ path: ["isModernOrder"], equals: true }],
-        holder: ["tenders", "encryptedCardTenders", 0],
-        fields: {
-            encryptedCardNumber: "cardNumber",
-            encryptedExpiryMonth: "expirationMonth",
-            encryptedExpiryYear: "expirationYear",
-            encryptedSecurityCode: "cvv"
-        },
-        // cardType and vinBalue describe the dummy the agent typed: the facts below
-        // write the approved card's instead, so nothing is removed.
-        remove: [],
-        refuse: [
-            { path: ["tenders", "encryptedCardTenders", 0, "saveForLater"], when: "true" },
-            // A saved card, or a second card tender the Vault never encrypted.
-            { path: ["tenders", "savedCardTender"], when: "present" },
-            { path: ["tenders", "encryptedCardTenders", 1], when: "present" },
-            // A gift card pays part of the order, so the card pays less than the total.
-            { path: ["tenders", "giftCardTenders"], when: "present" }
-        ],
-        amount: null,
-        // Read Sep 25, 2026 (research amount_source/dickssportinggoods). Every checkout call
-        // on the checkout page answers the whole checkout, camelCase on the wire: the page
-        // load's PATCH (or the create), then every address, shipping, promotion, gift card,
-        // tip and ScoreCard change. pricing.totalRemaining is what the card pays, a string
-        // with exactly two decimals ("123.45"; the page itself drops the dot for minor
-        // units). transactionReference is the checkout key, in the body and the URL. After
-        // payment the order submit and the confirmation read return the placed checkout.
-        amountSource: {
-            id: "dsg_checkout_pricing",
-            origin: "checkout",
-            format: "json",
-            responses: [
-                { method: "PATCH", path: "/api/v1/checkouts/:checkoutKey", query: {} },
-                { method: "POST", path: "/api/v1/checkouts", query: {} },
-                { method: "POST", path: "/api/v1/checkouts/:checkoutKey/addresses", queries: [{}, { type: "billing" }, { type: "shipping" }] },
-                { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/shipping/selected/groups/:groupNumber/mode", query: {} },
-                { method: "PUT", path: "/api/v2/checkouts/:checkoutKey/promotion/cart", query: {} },
-                { method: "DELETE", path: "/api/v2/checkouts/:checkoutKey/promotion/cart", query: {} },
-                { method: "POST", path: "/api/v1/checkouts/:checkoutKey/gift-cards", query: {} },
-                { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/gift-cards/:giftCardIndex", query: {} },
-                { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/tip", query: {} },
-                { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/scorecard", query: {} },
-                { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/scorecard", query: {} },
-                { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/v2/gifts", query: {} }
-            ],
-            total: { path: ["pricing", "totalRemaining"], format: "decimal2" },
-            unit: "major",
-            currency: "USD",
-            currencyPath: ["pricing", "currency"],
-            bind: [
-                { source: ["checkoutKey"], card: ["transactionReference"] },
-                { placeholder: "checkoutKey", card: ["transactionReference"] }
-            ],
-            // The order total and the card's share are the same text. Anything that lowers the
-            // share below the total (a gift card, ScoreCard rewards) or lands in only one of them
-            // (a tip, a donation) is refused until a HAR shows which one the charge follows, so
-            // the approved amount and the placed checkout's total read after payment agree.
-            requires: [{ path: ["pricing", "total"], equalsPath: ["pricing", "totalRemaining"] }],
-            refuse: [
-                // A placed checkout is not the one being paid.
-                { path: ["orderPlacedTime"], when: "true" },
-                // Gift cards and a checkout with no address yet (tax not estimated) wait for a HAR.
-                { path: ["payment", "giftCards"], when: "nonEmpty" },
-                { path: ["addresses"], when: "empty" }
-            ],
-            maxAgeMs: 9e5,
-            afterPayment: {
-                origin: "checkout",
-                format: "json",
-                responses: [
-                    { method: "POST", path: "/api/v1/checkouts/:checkoutKey", query: {} },
-                    { method: "GET", path: "/api/v1/checkouts/submitted/:checkoutKey", query: {} }
-                ],
-                // The order total, which the requires rule above held equal to the card's share
-                // before payment. totalRemaining is not read here: after placement it can drop to
-                // what is still unpaid, which would hide a higher charge.
-                total: { path: ["pricing", "total"], format: "decimal2" },
-                unit: "major",
-                currency: "USD",
-                currencyPath: ["pricing", "currency"],
-                bind: [
-                    { source: ["checkoutKey"], card: ["transactionReference"] },
-                    { placeholder: "checkoutKey", card: ["transactionReference"] }
-                ],
-                refuse: [{ path: ["orderPlacedTime"], when: "unset" }]
-            }
-        },
-        facts: [
-            // adyen-web's brand codes, the ones the page's supported list names; Dick's own
-            // private-label (plcc, comc) cards have no Agentcard brand and are refused.
-            {
-                path: ["tenders", "encryptedCardTenders", 0, "cardType"],
-                fact: "brand",
-                map: { visa: "visa", mastercard: "mc", amex: "amex", discover: "discover", diners: "diners", jcb: "jcb" }
-            },
-            { path: ["tenders", "encryptedCardTenders", 0, "vinBalue"], fact: "bin6" }
-        ],
-        adyen: {
-            environment: "live",
-            clientKey: "live_YJLFKT47JJG2RI7QIYX6HTKKDEDOEGOH",
-            publicKeySha256: "da33611149dff3ab715be8671c0550bb8aec6112983b2473db9ee7afb829c110"
-        }
-    },
+        ]
+    }),
     {
         // Read Sep 25, 2026, from public code only: the WooCommerce plugin super-payments 1.40.1 and
         // cdn.superpayments.com/js/v2/payment.webcomponents.script.js as it stood on Sep 19.

package/dist/merchant-hosted.js

@@ -17,7 +17,8 @@
  * the agent's dummy card never reaches the merchant and nothing is charged;
  * 'enabled' lets a prepared checkout pay it. The API can hold a profile in
  * 'observe' for a client but never enable it past this build: a profile is
- * 'enabled' only when both say so. Every profile ships in 'observe' today.
+ * 'enabled' only when both say so. Cinemark and Dick's own storefront ship
+ * 'enabled'; every other profile ships in 'observe'.
  */
 import { MERCHANT_PROFILE_RECOGNIZERS as SHARED_PROFILES, classifyDeclaredMerchantRequest as sharedClassifyDeclared, declaredTemplatedUrl as sharedDeclaredTemplatedUrl, declaredUrlGlobs as sharedDeclaredUrlGlobs, declaredUrlRelation as sharedDeclaredUrlRelation, declaredEndpointRefusal as sharedDeclaredEndpointRefusal, classifyMerchantRequest as sharedClassify, merchantBodyKeyPathSha256 as sharedKeyPathSha256, merchantProfileEnvironment as sharedEnvironment, merchantProfileRulesMatch as sharedRulesMatch, merchantProfileTemplatedUrl as sharedTemplatedUrl, merchantProfileUrlGlobs as sharedUrlGlobs, merchantProfileUrlRelation as sharedUrlRelation, sha256Hex as sharedSha256Hex, } from './adyen-merchant-hosted.generated.js';
 import { SubstitutionError, substituteMerchantHosted as sharedSubstitute } from './substitutions.generated.js';

package/dist/merchant-total.js

@@ -12,7 +12,10 @@
  *
  * What this proves: the total is what the agent's browser session saw. It catches a
  * mistyped amount and a cart that changed under the agent; it cannot tell a merchant's
- * response from one the agent wrote, so every profile priced this way stays in observe.
+ * response from one the agent wrote. So a profile priced this way stays in observe unless
+ * Agentcard accepted that risk for it by name (Cinemark and Dick's own storefront, Oct 7,
+ * 2026), and then it pays only for the company Agentcard enables it for, and only after the
+ * cardholder approves each payment.
  *
  * What the SDK owes payment-core (the header of merchant-amount.js): every exchange of
  * the profile's shapes, projected, with the time it left; a wait for any such request

package/dist/substitutions.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 6209fa4a22c349d03eed24ea4ff9e626334c5975ec515a4b7f6a83592343274f
+// artifact-sha256: a1b7d280655947da8bb1d465d17c3436504ee350dd0be7f345d524eea0f2f374
 // src/adyen-jwe.js
 var ADYEN_JWE_HEADER = { alg: "RSA-OAEP-256", enc: "A256GCM", version: "1" };
 var BASE64URL = /^[A-Za-z0-9_-]+$/;
@@ -277,6 +277,118 @@ function merchantBodyAmountPaths(profile) {
     return isPlainObject(amount) ? [amount.value, amount.currency].filter(Array.isArray) : [];
 }
 // src/merchant-profiles.js
+var DSG_PAYGATE_V2 = /* @__PURE__ */ deepFreeze({
+    method: "POST",
+    path: "/prod/api/paygate/v2/authorization",
+    query: {},
+    // The page sends true for every checkout its translator read, the only checkouts
+    // the amount source below maps; a legacy checkout is not this card request.
+    requires: [{ path: ["isModernOrder"], equals: true }],
+    holder: ["tenders", "encryptedCardTenders", 0],
+    fields: {
+        encryptedCardNumber: "cardNumber",
+        encryptedExpiryMonth: "expirationMonth",
+        encryptedExpiryYear: "expirationYear",
+        encryptedSecurityCode: "cvv"
+    },
+    // cardType and vinBalue describe the dummy the agent typed: the facts below
+    // write the approved card's instead, so nothing is removed.
+    remove: [],
+    refuse: [
+        { path: ["tenders", "encryptedCardTenders", 0, "saveForLater"], when: "true" },
+        // A saved card, or a second card tender the Vault never encrypted.
+        { path: ["tenders", "savedCardTender"], when: "present" },
+        { path: ["tenders", "encryptedCardTenders", 1], when: "present" },
+        // A gift card pays part of the order, so the card pays less than the total.
+        { path: ["tenders", "giftCardTenders"], when: "present" }
+    ],
+    amount: null,
+    // Read Sep 25, 2026 (research amount_source/dickssportinggoods). Every checkout call
+    // on the checkout page answers the whole checkout, camelCase on the wire: the page
+    // load's PATCH (or the create), then every address, shipping, promotion, gift card,
+    // tip and ScoreCard change. pricing.totalRemaining is what the card pays, a string
+    // with exactly two decimals ("123.45"; the page itself drops the dot for minor
+    // units). transactionReference is the checkout key, in the body and the URL. After
+    // payment the order submit and the confirmation read return the placed checkout.
+    amountSource: {
+        id: "dsg_checkout_pricing",
+        origin: "checkout",
+        format: "json",
+        responses: [
+            { method: "PATCH", path: "/api/v1/checkouts/:checkoutKey", query: {} },
+            { method: "POST", path: "/api/v1/checkouts", query: {} },
+            { method: "POST", path: "/api/v1/checkouts/:checkoutKey/addresses", queries: [{}, { type: "billing" }, { type: "shipping" }] },
+            { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/shipping/selected/groups/:groupNumber/mode", query: {} },
+            { method: "PUT", path: "/api/v2/checkouts/:checkoutKey/promotion/cart", query: {} },
+            { method: "DELETE", path: "/api/v2/checkouts/:checkoutKey/promotion/cart", query: {} },
+            { method: "POST", path: "/api/v1/checkouts/:checkoutKey/gift-cards", query: {} },
+            { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/gift-cards/:giftCardIndex", query: {} },
+            { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/tip", query: {} },
+            { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/scorecard", query: {} },
+            { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/scorecard", query: {} },
+            { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/v2/gifts", query: {} }
+        ],
+        total: { path: ["pricing", "totalRemaining"], format: "decimal2" },
+        unit: "major",
+        currency: "USD",
+        currencyPath: ["pricing", "currency"],
+        bind: [
+            { source: ["checkoutKey"], card: ["transactionReference"] },
+            { placeholder: "checkoutKey", card: ["transactionReference"] }
+        ],
+        // The order total and the card's share are the same text. Anything that lowers the
+        // share below the total (a gift card, ScoreCard rewards) or lands in only one of them
+        // (a tip, a donation) is refused until a HAR shows which one the charge follows, so
+        // the approved amount and the placed checkout's total read after payment agree.
+        requires: [{ path: ["pricing", "total"], equalsPath: ["pricing", "totalRemaining"] }],
+        refuse: [
+            // A placed checkout is not the one being paid.
+            { path: ["orderPlacedTime"], when: "true" },
+            // Gift cards and a checkout with no address yet (tax not estimated) wait for a HAR.
+            { path: ["payment", "giftCards"], when: "nonEmpty" },
+            { path: ["addresses"], when: "empty" }
+        ],
+        maxAgeMs: 9e5,
+        afterPayment: {
+            origin: "checkout",
+            format: "json",
+            responses: [
+                { method: "POST", path: "/api/v1/checkouts/:checkoutKey", query: {} },
+                { method: "GET", path: "/api/v1/checkouts/submitted/:checkoutKey", query: {} }
+            ],
+            // The order total, which the requires rule above held equal to the card's share
+            // before payment. totalRemaining is not read here: after placement it can drop to
+            // what is still unpaid, which would hide a higher charge.
+            total: { path: ["pricing", "total"], format: "decimal2" },
+            unit: "major",
+            currency: "USD",
+            currencyPath: ["pricing", "currency"],
+            bind: [
+                { source: ["checkoutKey"], card: ["transactionReference"] },
+                { placeholder: "checkoutKey", card: ["transactionReference"] }
+            ],
+            refuse: [{ path: ["orderPlacedTime"], when: "unset" }]
+        }
+    },
+    facts: [
+        // adyen-web's brand codes, the ones the page's supported list names; Dick's own
+        // private-label (plcc, comc) cards have no Agentcard brand and are refused.
+        {
+            path: ["tenders", "encryptedCardTenders", 0, "cardType"],
+            fact: "brand",
+            map: { visa: "visa", mastercard: "mc", amex: "amex", discover: "discover", diners: "diners", jcb: "jcb" }
+        },
+        { path: ["tenders", "encryptedCardTenders", 0, "vinBalue"], fact: "bin6" }
+    ],
+    adyen: {
+        environment: "live",
+        clientKey: "live_YJLFKT47JJG2RI7QIYX6HTKKDEDOEGOH",
+        publicKeySha256: "da33611149dff3ab715be8671c0550bb8aec6112983b2473db9ee7afb829c110"
+    }
+});
+function dsgPaygateProfile(own) {
+    return { ...own, ...DSG_PAYGATE_V2 };
+}
 var MERCHANT_HOSTED_PROFILES = /* @__PURE__ */ deepFreeze([
     {
         // Read Sep 23, 2026. assets.dunelm.com checkout-page bundle: submitPayment
@@ -372,10 +484,13 @@ var MERCHANT_HOSTED_PROFILES = /* @__PURE__ */ deepFreeze([
         // client key from the three securedFields iframes on
         // checkoutshopper-live-us.adyen.com (adyen-web 6.x). The request body itself
         // was not captured: the guest email gate stopped the run before Pay. Public
-        // key read from checkoutshopper-live-us.adyen.com on 2026-09-25 (UTC).
+        // key read from checkoutshopper-live-us.adyen.com on 2026-09-25 (UTC). Enabled
+        // Oct 7, 2026 under D1 (amountSource, above): live checks on Sep 30 and Oct 6
+        // matched its key pin, its card request as the page's script builds it, and its
+        // checkout total.
         id: "cinemark_initiate",
         merchant: "Cinemark",
-        status: "observe",
+        status: "enabled",
         origins: [{ checkout: "https://www.cinemark.com", endpoint: "https://www.cinemark.com" }],
         method: "POST",
         path: "/api/adyen/initiatePayment",
@@ -448,137 +563,29 @@ var MERCHANT_HOSTED_PROFILES = /* @__PURE__ */ deepFreeze([
             publicKeySha256: "9dd5ef549c7454d60ca970ff76c8f4cac36d79f2961e59eca9116791e86cbcc5"
         }
     },
-    {
-        // Read Sep 23, 2026. payments.dickssportinggoods.com/library/dppjs/index-v2.js
-        // (adyen-web 6.39.0): Dd() builds tenders.encryptedCardTenders[0] from the Card
-        // component's four JWEs as cardNumber, expirationMonth, expirationYear and cvv,
-        // beside cardType (adyen-web's first detected brand), saveForLater (the save-card
-        // box) and vinBalue (the six digits onBinValue reports). The page posts it with
-        // transactionReference, customer.device and any giftCardTenders to
-        // <payments host>/prod/api/paygate/v2/authorization, the host picked from the
-        // page's own (Dick's, Golf Galaxy, Public Lands, Going Going Gone). The same slot
-        // carries Afterpay, CashApp and Affirm tenders with literal strings where the JWEs
-        // go, and a saved card goes to tenders.savedCardTender instead. The body names no
-        // amount: the paygate charges the cart it holds for transactionReference.
-        // mountCCForm names the client key and environment 'live'. Public key read from
-        // checkoutshopper-live.adyen.com on 2026-09-25 (UTC).
+    /* @__PURE__ */ dsgPaygateProfile({
+        // Dick's own storefront, the one live checks read on Sep 30 and Oct 6, 2026: its key
+        // pin, its card request as the page's code builds it, its card facts and its checkout
+        // pricing matched DSG_PAYGATE_V2. Enabled Oct 7, 2026 under D1 (amountSource, above).
         id: "dsg_paygate_v2",
         merchant: "Dick's Sporting Goods",
+        status: "enabled",
+        origins: [
+            { checkout: "https://www.dickssportinggoods.com", endpoint: "https://payments.dickssportinggoods.com" }
+        ]
+    }),
+    /* @__PURE__ */ dsgPaygateProfile({
+        // The same paygate on the three other storefronts its page names. No live check has
+        // read them, so their card requests stay paused and aborted in observe.
+        id: "dsg_other_stores_paygate_v2",
+        merchant: "Golf Galaxy, Public Lands and Going Going Gone",
         status: "observe",
         origins: [
-            { checkout: "https://www.dickssportinggoods.com", endpoint: "https://payments.dickssportinggoods.com" },
             { checkout: "https://www.golfgalaxy.com", endpoint: "https://payments.golfgalaxy.com" },
             { checkout: "https://www.publiclands.com", endpoint: "https://payments.publiclands.com" },
             { checkout: "https://www.goinggoinggone.com", endpoint: "https://payments.goinggoinggone.com" }
-        ],
-        method: "POST",
-        path: "/prod/api/paygate/v2/authorization",
-        query: {},
-        // The page sends true for every checkout its translator read, the only checkouts
-        // the amount source below maps; a legacy checkout is not this card request.
-        requires: [{ path: ["isModernOrder"], equals: true }],
-        holder: ["tenders", "encryptedCardTenders", 0],
-        fields: {
-            encryptedCardNumber: "cardNumber",
-            encryptedExpiryMonth: "expirationMonth",
-            encryptedExpiryYear: "expirationYear",
-            encryptedSecurityCode: "cvv"
-        },
-        // cardType and vinBalue describe the dummy the agent typed: the facts below
-        // write the approved card's instead, so nothing is removed.
-        remove: [],
-        refuse: [
-            { path: ["tenders", "encryptedCardTenders", 0, "saveForLater"], when: "true" },
-            // A saved card, or a second card tender the Vault never encrypted.
-            { path: ["tenders", "savedCardTender"], when: "present" },
-            { path: ["tenders", "encryptedCardTenders", 1], when: "present" },
-            // A gift card pays part of the order, so the card pays less than the total.
-            { path: ["tenders", "giftCardTenders"], when: "present" }
-        ],
-        amount: null,
-        // Read Sep 25, 2026 (research amount_source/dickssportinggoods). Every checkout call
-        // on the checkout page answers the whole checkout, camelCase on the wire: the page
-        // load's PATCH (or the create), then every address, shipping, promotion, gift card,
-        // tip and ScoreCard change. pricing.totalRemaining is what the card pays, a string
-        // with exactly two decimals ("123.45"; the page itself drops the dot for minor
-        // units). transactionReference is the checkout key, in the body and the URL. After
-        // payment the order submit and the confirmation read return the placed checkout.
-        amountSource: {
-            id: "dsg_checkout_pricing",
-            origin: "checkout",
-            format: "json",
-            responses: [
-                { method: "PATCH", path: "/api/v1/checkouts/:checkoutKey", query: {} },
-                { method: "POST", path: "/api/v1/checkouts", query: {} },
-                { method: "POST", path: "/api/v1/checkouts/:checkoutKey/addresses", queries: [{}, { type: "billing" }, { type: "shipping" }] },
-                { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/shipping/selected/groups/:groupNumber/mode", query: {} },
-                { method: "PUT", path: "/api/v2/checkouts/:checkoutKey/promotion/cart", query: {} },
-                { method: "DELETE", path: "/api/v2/checkouts/:checkoutKey/promotion/cart", query: {} },
-                { method: "POST", path: "/api/v1/checkouts/:checkoutKey/gift-cards", query: {} },
-                { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/gift-cards/:giftCardIndex", query: {} },
-                { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/tip", query: {} },
-                { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/scorecard", query: {} },
-                { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/scorecard", query: {} },
-                { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/v2/gifts", query: {} }
-            ],
-            total: { path: ["pricing", "totalRemaining"], format: "decimal2" },
-            unit: "major",
-            currency: "USD",
-            currencyPath: ["pricing", "currency"],
-            bind: [
-                { source: ["checkoutKey"], card: ["transactionReference"] },
-                { placeholder: "checkoutKey", card: ["transactionReference"] }
-            ],
-            // The order total and the card's share are the same text. Anything that lowers the
-            // share below the total (a gift card, ScoreCard rewards) or lands in only one of them
-            // (a tip, a donation) is refused until a HAR shows which one the charge follows, so
-            // the approved amount and the placed checkout's total read after payment agree.
-            requires: [{ path: ["pricing", "total"], equalsPath: ["pricing", "totalRemaining"] }],
-            refuse: [
-                // A placed checkout is not the one being paid.
-                { path: ["orderPlacedTime"], when: "true" },
-                // Gift cards and a checkout with no address yet (tax not estimated) wait for a HAR.
-                { path: ["payment", "giftCards"], when: "nonEmpty" },
-                { path: ["addresses"], when: "empty" }
-            ],
-            maxAgeMs: 9e5,
-            afterPayment: {
-                origin: "checkout",
-                format: "json",
-                responses: [
-                    { method: "POST", path: "/api/v1/checkouts/:checkoutKey", query: {} },
-                    { method: "GET", path: "/api/v1/checkouts/submitted/:checkoutKey", query: {} }
-                ],
-                // The order total, which the requires rule above held equal to the card's share
-                // before payment. totalRemaining is not read here: after placement it can drop to
-                // what is still unpaid, which would hide a higher charge.
-                total: { path: ["pricing", "total"], format: "decimal2" },
-                unit: "major",
-                currency: "USD",
-                currencyPath: ["pricing", "currency"],
-                bind: [
-                    { source: ["checkoutKey"], card: ["transactionReference"] },
-                    { placeholder: "checkoutKey", card: ["transactionReference"] }
-                ],
-                refuse: [{ path: ["orderPlacedTime"], when: "unset" }]
-            }
-        },
-        facts: [
-            // adyen-web's brand codes, the ones the page's supported list names; Dick's own
-            // private-label (plcc, comc) cards have no Agentcard brand and are refused.
-            {
-                path: ["tenders", "encryptedCardTenders", 0, "cardType"],
-                fact: "brand",
-                map: { visa: "visa", mastercard: "mc", amex: "amex", discover: "discover", diners: "diners", jcb: "jcb" }
-            },
-            { path: ["tenders", "encryptedCardTenders", 0, "vinBalue"], fact: "bin6" }
-        ],
-        adyen: {
-            environment: "live",
-            clientKey: "live_YJLFKT47JJG2RI7QIYX6HTKKDEDOEGOH",
-            publicKeySha256: "da33611149dff3ab715be8671c0550bb8aec6112983b2473db9ee7afb829c110"
-        }
-    },
+        ]
+    }),
     {
         // Read Sep 25, 2026, from public code only: the WooCommerce plugin super-payments 1.40.1 and
         // cdn.superpayments.com/js/v2/payment.webcomponents.script.js as it stood on Sep 19.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.3",
+  "version": "0.23.4",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",