@agent-cards/sdk 0.23.9 → 0.23.11

package/dist/verifone.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: cf655438763f54e5d5bfea2555f76941ef80dbfd5aa7bc6342a2a75d1ac9cd39
+// artifact-sha256: db732bdbb517b37ea27d05debafb7659bb456f686edd0c90d78b2fbdb993d68d
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -415,18 +415,44 @@ var VERIFONE_MERCHANT_PROFILES = /* @__PURE__ */ deepFreeze([
         // employee variants (featureConfig verifoneCCEnabled, verifonePLCCEnabled,
         // verifoneEmployeeCCEnabled, verifoneEmployeePLCCEnabled; live from late 2023, still on
         // 2026-09-19). Checkout is www.containerstore.com/checkout?fulfillmentMethod=STANDARD|PICKUP,
-        // on the legacy app behind PerimeterX. Its card request has never been observed: the
-        // CheckoutV2 bundle was never archived and the page is session-gated. So no leg and no key
-        // are pinned, and every blob-bearing request to www.containerstore.com is aborted, until one
-        // person-run checkout captured as a HAR pins the endpoint, the member holding the blob, the
-        // key and its alias, and whether the blob is sent once or twice.
+        // on the legacy app behind PerimeterX.
+        //
+        // The card request, read from TCS's own CheckoutV2 build 3.340.1.16022 (its public source
+        // map: CheckoutForm and the checkout service) and its live guest checkout on 2026-10-10:
+        // Place Order encrypts the card once with verifone.js, and axios posts the order once, as
+        // JSON, to /checkout/api/submit, with the new card last in paymentMethods after any gift
+        // card, as {defaultWallet, cardNumber (masked but its last four), encryptedCard, type
+        // 'CREDIT_CARD', cardType}. A saved card is type 'COF' with a walletId, TCS's own card
+        // 'TCS_CREDIT_CARD'; defaultWallet saves the card to the shopper's wallet, and
+        // popTermsAndConditionsAccepted (the form's popEnroll box) enrolls them in TCS's loyalty
+        // program, Organized Insider (once POP!). A gift card's balance check posts its own blob to
+        // /checkout/api/gift-card, which aborts like any request off the leg.
+        //
+        // The body names no amount (TCS's total is only in its cart response), and the key the page
+        // encrypts under, its verifoneEncryptionKey, is not pinned (verifone-keys.js). So the profile
+        // stays in observe: the leg's requests abort as unreviewed until a person pins the key and the
+        // merchant's total has a reviewed source.
         id: "containerstore_checkout",
         merchant: "The Container Store",
         processor: "verifone",
         status: "observe",
         environment: "production",
         origins: [{ checkout: "https://www.containerstore.com", endpoint: "https://www.containerstore.com" }],
-        legs: [],
+        legs: [{
+                name: "card",
+                method: "POST",
+                path: "/checkout/api/submit",
+                query: {},
+                requires: [{ path: ["paymentMethods", 0, "type"], equals: "CREDIT_CARD" }],
+                refuse: [
+                    { path: ["paymentMethods", 1], when: "present" },
+                    { path: ["paymentMethods", 0, "defaultWallet"], when: "true" },
+                    { path: ["paymentMethods", 0, "walletId"], when: "present" },
+                    { path: ["popTermsAndConditionsAccepted"], when: "true" }
+                ],
+                holder: ["paymentMethods", 0],
+                field: "encryptedCard"
+            }],
         keyPin: null,
         amount: null
     }
@@ -652,8 +678,143 @@ function decodeBase64(text) {
     }
     return encodeBase64(out) === text ? out : null;
 }
+// src/secp256k1.js
+var P = (1n << 256n) - (1n << 32n) - 977n;
+var N = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141n;
+var G = Object.freeze({
+    x: 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798n,
+    y: 0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8n
+});
+var BYTES = 32;
+var MAX_DRAWS = 16;
+var mod = (a) => {
+    const r = a % P;
+    return r < 0n ? r + P : r;
+};
+function toBigInt(bytes) {
+    let hex2 = "0";
+    for (let i = 0; i < bytes.length; i++)
+        hex2 += (bytes[i] < 16 ? "0" : "") + bytes[i].toString(16);
+    return BigInt(`0x${hex2}`);
+}
+function toBytes(value) {
+    const hex2 = value.toString(16).padStart(BYTES * 2, "0");
+    const out = new Uint8Array(BYTES);
+    for (let i = 0; i < BYTES; i++)
+        out[i] = parseInt(hex2.slice(2 * i, 2 * i + 2), 16);
+    return out;
+}
+function decodePoint(bytes) {
+    if (!(bytes instanceof Uint8Array) || bytes.length !== 1 + 2 * BYTES || bytes[0] !== 4)
+        return null;
+    const x = toBigInt(bytes.subarray(1, 1 + BYTES));
+    const y = toBigInt(bytes.subarray(1 + BYTES));
+    if (x >= P || y >= P)
+        return null;
+    return mod(y * y) === mod(x * x * x + 7n) ? { x, y } : null;
+}
+function isSecp256k1Point(bytes) {
+    return decodePoint(bytes) !== null;
+}
+var INFINITY = Object.freeze({ X: 0n, Y: 1n, Z: 0n });
+function double(p) {
+    if (p.Z === 0n || p.Y === 0n)
+        return INFINITY;
+    const a = mod(p.X * p.X);
+    const b = mod(p.Y * p.Y);
+    const c = mod(b * b);
+    const d = mod(2n * (mod((p.X + b) * (p.X + b)) - a - c));
+    const e = mod(3n * a);
+    const X = mod(e * e - 2n * d);
+    return { X, Y: mod(e * (d - X) - 8n * c), Z: mod(2n * p.Y * p.Z) };
+}
+function add(p, q) {
+    if (p.Z === 0n)
+        return q;
+    if (q.Z === 0n)
+        return p;
+    const z1z1 = mod(p.Z * p.Z);
+    const z2z2 = mod(q.Z * q.Z);
+    const u1 = mod(p.X * z2z2);
+    const u2 = mod(q.X * z1z1);
+    const s1 = mod(p.Y * q.Z * z2z2);
+    const s2 = mod(q.Y * p.Z * z1z1);
+    const h = mod(u2 - u1);
+    const r = mod(2n * (s2 - s1));
+    if (h === 0n)
+        return r === 0n ? double(p) : INFINITY;
+    const i = mod(4n * h * h);
+    const j = mod(h * i);
+    const v = mod(u1 * i);
+    const X = mod(r * r - j - 2n * v);
+    return { X, Y: mod(r * (v - X) - 2n * s1 * j), Z: mod((mod((p.Z + q.Z) * (p.Z + q.Z)) - z1z1 - z2z2) * h) };
+}
+function power(base, exponent) {
+    let result = 1n;
+    let square = mod(base);
+    for (let rest = exponent; rest > 0n; rest >>= 1n) {
+        if (rest & 1n)
+            result = mod(result * square);
+        square = mod(square * square);
+    }
+    return result;
+}
+function multiply(k, point) {
+    let r0 = INFINITY;
+    let r1 = { X: point.x, Y: point.y, Z: 1n };
+    for (let i = 255; i >= 0; i--) {
+        if (k >> BigInt(i) & 1n) {
+            r0 = add(r0, r1);
+            r1 = double(r1);
+        }
+        else {
+            r1 = add(r0, r1);
+            r0 = double(r0);
+        }
+    }
+    if (r0.Z === 0n)
+        return null;
+    const inverse = power(r0.Z, P - 2n);
+    const inverse2 = mod(inverse * inverse);
+    return { x: mod(r0.X * inverse2), y: mod(r0.Y * inverse2 * inverse) };
+}
+function ephemeralScalar(random) {
+    if (!random || typeof random.getRandomValues !== "function")
+        throw new Error("Refusing to encrypt: no random source.");
+    const draw = new Uint8Array(BYTES);
+    try {
+        for (let round = 0; round < MAX_DRAWS; round++) {
+            random.getRandomValues(draw);
+            const k = toBigInt(draw);
+            if (k > 0n && k < N)
+                return k;
+        }
+    }
+    finally {
+        draw.fill(0);
+    }
+    throw new Error("Refusing to encrypt: the random source drew no usable key.");
+}
+function secp256k1Agreement(recipient, random) {
+    const q = decodePoint(recipient);
+    if (!q)
+        throw new Error("Refusing to encrypt: the key is not a point on secp256k1.");
+    const k = ephemeralScalar(random);
+    const v = multiply(k, G);
+    const s = multiply(k, q);
+    if (!v || !s)
+        throw new Error("Refusing to encrypt: the key agreement reached the point at infinity.");
+    const ephemeralPoint = new Uint8Array(1 + 2 * BYTES);
+    ephemeralPoint[0] = 4;
+    ephemeralPoint.set(toBytes(v.x), 1);
+    ephemeralPoint.set(toBytes(v.y), 1 + BYTES);
+    return { ephemeralPoint, sharedSecret: toBytes(s.x) };
+}
 // src/verifone-pgp.js
-var P256_OID = Object.freeze([42, 134, 72, 206, 61, 3, 1, 7]);
+var CURVE_OIDS = Object.freeze({
+    "P-256": Object.freeze([42, 134, 72, 206, 61, 3, 1, 7]),
+    secp256k1: Object.freeze([43, 129, 4, 0, 10])
+});
 var ALGORITHM_ECDH = 18;
 var ENCRYPTING_ALGORITHMS = Object.freeze([1, 2, 16, 18]);
 var KNOWN_SYMMETRIC = Object.freeze([2, 3, 4, 7, 8, 9, 10]);
@@ -863,7 +1024,8 @@ function keyPacket(body) {
 function ecdhFields(fields) {
     const oidLength = fields[0];
     const oid = fields.subarray(1, 1 + oidLength);
-    if (oidLength !== P256_OID.length || !sameBytes(oid, P256_OID))
+    const curve = sameBytes(oid, CURVE_OIDS["P-256"]) ? "P-256" : sameBytes(oid, CURVE_OIDS.secp256k1) ? "secp256k1" : null;
+    if (!curve)
         return { refusal: "verifone_key_curve_unsupported" };
     let at = 1 + oidLength;
     const bits = fields[at] << 8 | fields[at + 1];
@@ -871,12 +1033,14 @@ function ecdhFields(fields) {
     at += 2 + point.length;
     if (bits !== 515 || point.length !== 65 || point[0] !== 4)
         return { refusal: "verifone_key_malformed" };
+    if (curve === "secp256k1" && !isSecp256k1Point(point))
+        return { refusal: "verifone_key_malformed" };
     const kdf = fields.subarray(at, at + 1 + fields[at]);
     if (kdf.length !== 4 || kdf[0] !== 3 || kdf[1] !== 1 || at + 4 !== fields.length)
         return { refusal: "verifone_key_malformed" };
     if (!KDF_HASHES[kdf[2]] || !AES[kdf[3]])
         return { refusal: "verifone_key_kdf_unsupported" };
-    return { point: Uint8Array.from(point), kdfHash: kdf[2], kekAlgorithm: kdf[3] };
+    return { curve, point: Uint8Array.from(point), kdfHash: kdf[2], kekAlgorithm: kdf[3] };
 }
 async function fingerprintOf(body, subtle) {
     return new Uint8Array(await subtle.digest("SHA-1", concat(Uint8Array.of(153), u16(body.length), body)));
@@ -962,6 +1126,7 @@ async function readVerifonePublicKey(publicKeyBase64, facilities) {
         primaryFingerprint: hex(primaryFingerprint),
         encryptionSubkeyId: hex(fingerprint.subarray(12, 20)),
         encryptionFingerprint: fingerprint,
+        curve: ecdh.curve,
         point: ecdh.point,
         kdfHash: ecdh.kdfHash,
         kekAlgorithm: ecdh.kekAlgorithm,
@@ -999,21 +1164,31 @@ ${MESSAGE_END}\r
 `;
     return encodeBase64(asciiBytes(armored));
 }
+async function agree(curve, point, crypto) {
+    if (curve === "secp256k1") {
+        const { ephemeralPoint: ephemeralPoint2, sharedSecret } = secp256k1Agreement(point, crypto);
+        return { ephemeralPoint: ephemeralPoint2, shared: sharedSecret };
+    }
+    const subtle = crypto.subtle;
+    const ephemeral = await subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, ["deriveBits"]);
+    const ephemeralPoint = new Uint8Array(await subtle.exportKey("raw", ephemeral.publicKey));
+    const recipient = await subtle.importKey("raw", point, { name: "ECDH", namedCurve: "P-256" }, false, []);
+    const shared = new Uint8Array(await subtle.deriveBits({ name: "ECDH", public: recipient }, ephemeral.privateKey, 256));
+    return { ephemeralPoint, shared };
+}
 async function verifoneEncryptText(key, text, facilities) {
     const crypto = facilities?.crypto;
     const subtle = crypto?.subtle;
     if (!subtle || typeof crypto.getRandomValues !== "function")
         throw new Error("Refusing to encrypt: no WebCrypto.");
-    if (!key || key.refusal || !(key.point instanceof Uint8Array) || !AES[key.sessionCipher] || !AES[key.kekAlgorithm] || !KDF_HASHES[key.kdfHash]) {
+    const oid = key && Object.prototype.hasOwnProperty.call(CURVE_OIDS, key.curve) ? CURVE_OIDS[key.curve] : null;
+    if (!key || key.refusal || !oid || !(key.point instanceof Uint8Array) || !AES[key.sessionCipher] || !AES[key.kekAlgorithm] || !KDF_HASHES[key.kdfHash]) {
         throw new Error("Refusing to encrypt: the Verifone key is not one this codec reads.");
     }
     if (!Number.isSafeInteger(facilities.nowMs) || facilities.nowMs < 0)
         throw new Error("Refusing to encrypt: no clock.");
-    const ephemeral = await subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, ["deriveBits"]);
-    const ephemeralPoint = new Uint8Array(await subtle.exportKey("raw", ephemeral.publicKey));
-    const recipient = await subtle.importKey("raw", key.point, { name: "ECDH", namedCurve: "P-256" }, false, []);
-    const shared = new Uint8Array(await subtle.deriveBits({ name: "ECDH", public: recipient }, ephemeral.privateKey, 256));
-    const param = concat(Uint8Array.of(P256_OID.length), Uint8Array.from(P256_OID), Uint8Array.of(ALGORITHM_ECDH, 3, 1, key.kdfHash, key.kekAlgorithm), asciiBytes("Anonymous Sender    "), key.encryptionFingerprint);
+    const { ephemeralPoint, shared } = await agree(key.curve, key.point, crypto);
+    const param = concat(Uint8Array.of(oid.length), Uint8Array.from(oid), Uint8Array.of(ALGORITHM_ECDH, 3, 1, key.kdfHash, key.kekAlgorithm), asciiBytes("Anonymous Sender    "), key.encryptionFingerprint);
     const derived = new Uint8Array(await subtle.digest(KDF_HASHES[key.kdfHash], concat(u32(1), shared, param)));
     const kek = await subtle.importKey("raw", derived.subarray(0, AES[key.kekAlgorithm]), "AES-KW", false, ["wrapKey"]);
     const sessionKey = crypto.getRandomValues(new Uint8Array(AES[key.sessionCipher]));
@@ -1142,7 +1317,7 @@ function verifoneClockSkewRefusal(deviceNowMs, serverNowMs) {
 }
 var KEY_REFUSALS = Object.freeze({
     verifone_key_unpinned: "Refusing to encrypt: Agentcard has not pinned this Verifone key.",
-    verifone_key_curve_unsupported: "Refusing to encrypt: the Verifone key is not on NIST P-256.",
+    verifone_key_curve_unsupported: "Refusing to encrypt: the Verifone key is on neither NIST P-256 nor secp256k1.",
     verifone_key_expired: "Refusing to encrypt: this Verifone key has expired.",
     verifone_key_revoked: "Refusing to encrypt: this Verifone key was revoked."
 });

package/dist/verifone.js

@@ -18,7 +18,7 @@
  * key paths, never a value) and aborts it, so the agent's placeholder card never
  * reaches the merchant and nothing is charged; 'enabled' lets a prepared checkout
  * pay the reviewed leg. A profile is 'enabled' only when the API and this build both
- * say so. The Container Store ships in 'observe', with no leg and no key reviewed.
+ * say so. The Container Store ships in 'observe', its card request reviewed and no key pinned.
  */
 import * as generated from './verifone.generated.js';
 import { sha256Hex as sharedSha256Hex } from './adyen-merchant-hosted.generated.js';

package/dist/worldline-mycheckout.d.ts

@@ -0,0 +1,27 @@
+/** Whether `url` is one of MyCheckout's four card-form endpoints, written exactly (payment-core's rule). */
+export declare function isWorldlineMyCheckoutEndpoint(url: string): boolean;
+/** The `blocked` detail for a card submit whose product is not the one its page chose. */
+export declare const WORLDLINE_MYCHECKOUT_PRODUCT_CHANGED = "worldline_mycheckout_product_changed";
+/** The `blocked` detail for a card submit that names no product, on a hosted checkout whose page chose one. */
+export declare const WORLDLINE_MYCHECKOUT_PRODUCT_MISSING = "worldline_mycheckout_product_missing";
+export type WorldlineMyCheckoutRefusal = typeof WORLDLINE_MYCHECKOUT_PRODUCT_CHANGED | typeof WORLDLINE_MYCHECKOUT_PRODUCT_MISSING;
+/**
+ * The card products one attachment saw chosen, per hosted checkout: its `publicMerchantId` and
+ * `token`, the pair payment-core's duplicate guard reads as one hosted checkout
+ * (WORLDLINE_MYCHECKOUT_DEDUPE).
+ */
+export declare class WorldlineMyCheckoutProducts {
+    private readonly chosen;
+    /**
+     * Read one POST to a card-form endpoint. A product selection (no card, and neither the Pay nor
+     * the cancel pair) records the product it chose for its hosted checkout, or forgets the choice
+     * when it picks the card group, which leaves the product to the card. A card submit is judged:
+     * WORLDLINE_MYCHECKOUT_PRODUCT_CHANGED when its paymentProductId is another product than the one
+     * chosen for its hosted checkout, WORLDLINE_MYCHECKOUT_PRODUCT_MISSING when it names none. Null for
+     * every other post, and for a card submit on the card group or on a hosted checkout whose choice
+     * this attachment never saw: the API and the device judge those as before. A body payment-core
+     * cannot read is never judged here either.
+     */
+    judge(url: string, body: string | null): WorldlineMyCheckoutRefusal | null;
+    private remember;
+}

package/dist/worldline-mycheckout.generated.d.ts

@@ -0,0 +1,29 @@
+declare var WORLDLINE_MYCHECKOUT_PSP: string;
+declare var WORLDLINE_MYCHECKOUT_CAPABILITY: string;
+declare var WORLDLINE_MYCHECKOUT_ENDPOINTS: Readonly<{
+    production: readonly string[];
+    sandbox: readonly string[];
+}>;
+declare function worldlineMyCheckoutEnvironment(url: any): "production" | "sandbox" | undefined;
+declare function isWorldlineMyCheckoutUrl(url: any): boolean;
+declare var WORLDLINE_MYCHECKOUT_CARD_PRODUCTS: Readonly<{
+    visa: readonly string[];
+    mastercard: readonly string[];
+    amex: readonly string[];
+    discover: readonly string[];
+    jcb: readonly string[];
+    diners: readonly string[];
+}>;
+declare function worldlineMyCheckoutProductNetwork(productId: any): string | null;
+declare function parseWorldlineMyCheckoutForm(body: any): {
+    refusal: string;
+    pairs?: undefined;
+} | {
+    pairs: string[][];
+    refusal?: undefined;
+};
+declare function worldlineMyCheckoutCardholderName(name: any): string | null;
+declare function worldlineMyCheckoutTemplateRefusal(body: any): string | null;
+declare function worldlineMyCheckoutRequestRefusal(request: any): string | null;
+declare var WORLDLINE_MYCHECKOUT_DEDUPE: readonly string[];
+export { WORLDLINE_MYCHECKOUT_CAPABILITY, WORLDLINE_MYCHECKOUT_CARD_PRODUCTS, WORLDLINE_MYCHECKOUT_DEDUPE, WORLDLINE_MYCHECKOUT_ENDPOINTS, WORLDLINE_MYCHECKOUT_PSP, isWorldlineMyCheckoutUrl, parseWorldlineMyCheckoutForm, worldlineMyCheckoutCardholderName, worldlineMyCheckoutEnvironment, worldlineMyCheckoutProductNetwork, worldlineMyCheckoutRequestRefusal, worldlineMyCheckoutTemplateRefusal };

package/dist/worldline-mycheckout.generated.js

@@ -0,0 +1,162 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: 486a32aa0f96f59666d4a43e42fee9f493cd3059b27ad3f92b97ad6b249133f5
+// src/worldline-mycheckout.js
+var WORLDLINE_MYCHECKOUT_PSP = "worldline_mycheckout";
+var WORLDLINE_MYCHECKOUT_CAPABILITY = "worldline_mycheckout_form";
+var WORLDLINE_MYCHECKOUT_ENDPOINTS = /* @__PURE__ */ Object.freeze({
+    production: /* @__PURE__ */ Object.freeze([
+        "https://payment.pay1.checkout.worldline-solutions.com/checkout",
+        "https://payment.pay2.checkout.worldline-solutions.com/checkout"
+    ]),
+    sandbox: /* @__PURE__ */ Object.freeze([
+        "https://payment.pay1.preprod.checkout.worldline-solutions.com/checkout",
+        "https://payment.pay2.preprod.checkout.worldline-solutions.com/checkout"
+    ])
+});
+function worldlineMyCheckoutEnvironment(url) {
+    if (WORLDLINE_MYCHECKOUT_ENDPOINTS.production.includes(url))
+        return "production";
+    if (WORLDLINE_MYCHECKOUT_ENDPOINTS.sandbox.includes(url))
+        return "sandbox";
+    return void 0;
+}
+function isWorldlineMyCheckoutUrl(url) {
+    return worldlineMyCheckoutEnvironment(url) !== void 0;
+}
+var WORLDLINE_MYCHECKOUT_CARD_PRODUCTS = /* @__PURE__ */ Object.freeze({
+    visa: /* @__PURE__ */ Object.freeze(["1", "114", "122"]),
+    mastercard: /* @__PURE__ */ Object.freeze(["3", "119"]),
+    amex: /* @__PURE__ */ Object.freeze(["2"]),
+    discover: /* @__PURE__ */ Object.freeze(["128"]),
+    jcb: /* @__PURE__ */ Object.freeze(["125"]),
+    diners: /* @__PURE__ */ Object.freeze(["132"])
+});
+function worldlineMyCheckoutProductNetwork(productId) {
+    for (const [network, ids] of Object.entries(WORLDLINE_MYCHECKOUT_CARD_PRODUCTS)) {
+        if (ids.includes(productId))
+            return network;
+    }
+    return null;
+}
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var FIELDS = {
+    publicMerchantId: /^[1-9]\d{0,9}$/,
+    variantCode: /^\d{1,10}$/,
+    locale: /^[a-z]{2}_[A-Z]{2}$/,
+    idempotenceKey: UUID,
+    // <merchant id>-<32 hex>:<hosted checkout id>:<32 hex>, the hosted checkout's own id.
+    token: /^[1-9]\d{0,9}-[0-9a-f]{32}:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}:[0-9a-f]{32}$/,
+    requestToken: UUID,
+    isPaymentProductDetailsShown: /^(?:true|false)$/,
+    isPaymentProductFiscalNumberShown: /^(?:true|false)$/,
+    jsEnabled: /^true$/,
+    isFramed: /^(?:true|false)$/,
+    paymentProductId: /^\d{1,4}$/,
+    paymentProductGroupId: /^cards$/,
+    colorDepth: /^\d{0,3}$/,
+    screenHeight: /^\d{0,5}$/,
+    screenWidth: /^\d{0,5}$/,
+    innerHeight: /^\d{0,5}$/,
+    innerWidth: /^\d{0,5}$/,
+    timezoneOffsetUtcMinutes: /^-?\d{0,4}$/,
+    browserLocale: /^[A-Za-z0-9-]{0,35}$/,
+    javaEnabled: /^(?:true|false)?$/,
+    cardNumber: /^[0-9 ]{12,23}$/,
+    // MM/YY as the page's mask writes it; the delimiter may be absent or padded.
+    expiryDate: /^(?:0[1-9]|1[0-2])(?: ?\/ ?)?\d{2}$/,
+    cvv: /^\d{3,4}$/,
+    cardholderName: /^[^\u0000-\u001f\u007f<>]{0,100}$/,
+    // The autofill helpers the page folds into expiryDate and then empties.
+    expiryDateMonth: /^$/,
+    expiryDateYear: /^$/,
+    // A checked "remember" asks Worldline to keep the card for later purchases.
+    remember: /^$/,
+    // Present, empty, on a page that offers Click to Pay; a value is a Click to Pay payment.
+    clickToPayCheckoutResponseSignature: /^$/,
+    // The Pay button's own pair. The click handler writes it into #buttonValue and appends one
+    // more copy per click, so it may repeat, always as doPayment=doPayment.
+    doPayment: /^doPayment$/
+};
+var REPEATABLE = /* @__PURE__ */ new Set(["doPayment"]);
+var REQUIRED = ["publicMerchantId", "token", "requestToken", "idempotenceKey", "doPayment", "cardNumber", "expiryDate", "cvv"];
+var NOT_A_CARD_SALE = /* @__PURE__ */ new Set(["cancelPayment", "encryptedPaymentData", "mobileCardholderName"]);
+var BODY_LIMIT = 16384;
+var VALUE_LIMIT = 2048;
+function parseWorldlineMyCheckoutForm(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT || /[^\x21-\x7e]/.test(body))
+        return { refusal: "body" };
+    const pairs = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const chunk of body.split("&")) {
+        const eq = chunk.indexOf("=");
+        if (eq < 1)
+            return { refusal: "body" };
+        let key;
+        let value;
+        try {
+            key = decodeURIComponent(chunk.slice(0, eq).replace(/\+/g, " "));
+            value = decodeURIComponent(chunk.slice(eq + 1).replace(/\+/g, " "));
+        }
+        catch {
+            return { refusal: "body" };
+        }
+        if (value.length > VALUE_LIMIT || /[\u0000-\u001f\u007f]/.test(value))
+            return { refusal: "body" };
+        if (seen.has(key) && !REPEATABLE.has(key))
+            return { refusal: "body" };
+        seen.add(key);
+        pairs.push([key, value]);
+    }
+    return { pairs };
+}
+var SESSION_FIELDS = /* @__PURE__ */ new Set(["publicMerchantId", "token", "requestToken", "idempotenceKey"]);
+var CARD_FIELDS = /* @__PURE__ */ new Set(["cardNumber", "expiryDate", "cvv", "cardholderName", "expiryDateMonth", "expiryDateYear"]);
+function worldlineMyCheckoutCardholderName(name) {
+    if (typeof name !== "string")
+        return null;
+    const trimmed = name.trim();
+    return trimmed !== "" && FIELDS.cardholderName.test(trimmed) ? trimmed : null;
+}
+function worldlineMyCheckoutTemplateRefusal(body) {
+    const parsed = parseWorldlineMyCheckoutForm(body);
+    if (parsed.refusal)
+        return parsed.refusal;
+    const values = /* @__PURE__ */ new Map();
+    for (const [key, value] of parsed.pairs) {
+        if (NOT_A_CARD_SALE.has(key) || key === "clickToPayCheckoutResponseSignature" && value !== "")
+            return "not_a_card_sale";
+        if (key === "remember" && value !== "")
+            return "stored_card";
+        if (!Object.hasOwn(FIELDS, key))
+            return "unknown_field";
+        values.set(key, value);
+    }
+    for (const key of REQUIRED)
+        if (!values.has(key))
+            return "missing_field";
+    for (const [key, value] of parsed.pairs) {
+        if (FIELDS[key].test(value))
+            continue;
+        return SESSION_FIELDS.has(key) ? "session" : CARD_FIELDS.has(key) ? "card_fields" : "field_value";
+    }
+    if (values.get("token").split("-")[0] !== values.get("publicMerchantId"))
+        return "session";
+    const product = values.get("paymentProductId");
+    if (product === void 0 ? !values.has("paymentProductGroupId") : worldlineMyCheckoutProductNetwork(product) === null)
+        return "product";
+    return null;
+}
+function worldlineMyCheckoutRequestRefusal(request) {
+    if (!request || typeof request !== "object" || !isWorldlineMyCheckoutUrl(request.url))
+        return "endpoint";
+    if (request.method !== "POST")
+        return "method";
+    const headers = request.headers && typeof request.headers === "object" ? request.headers : {};
+    const types = Object.entries(headers).filter(([name]) => name.toLowerCase() === "content-type");
+    if (types.length !== 1 || typeof types[0][1] !== "string" || !/^application\/x-www-form-urlencoded(?:;\s*charset=utf-8)?$/i.test(types[0][1].trim()))
+        return "content_type";
+    return worldlineMyCheckoutTemplateRefusal(request.body);
+}
+var WORLDLINE_MYCHECKOUT_DEDUPE = /* @__PURE__ */ Object.freeze(["publicMerchantId", "token"]);
+export { WORLDLINE_MYCHECKOUT_CAPABILITY, WORLDLINE_MYCHECKOUT_CARD_PRODUCTS, WORLDLINE_MYCHECKOUT_DEDUPE, WORLDLINE_MYCHECKOUT_ENDPOINTS, WORLDLINE_MYCHECKOUT_PSP, isWorldlineMyCheckoutUrl, parseWorldlineMyCheckoutForm, worldlineMyCheckoutCardholderName, worldlineMyCheckoutEnvironment, worldlineMyCheckoutProductNetwork, worldlineMyCheckoutRequestRefusal, worldlineMyCheckoutTemplateRefusal };

package/dist/worldline-mycheckout.js

@@ -0,0 +1,93 @@
+// Worldline Connect MyCheckout (psp `worldline_mycheckout`): the hosted payment page whose card
+// form posts the card as a top-level navigation to /checkout on Worldline's own host. The form
+// rules are payment-core's (worldline-mycheckout.generated.ts): the API applies them at create,
+// and the cardholder's device applies them again before it rebuilds the form with the real card.
+// This module holds the one thing only the SDK can decide: which card product the page chose.
+//
+// A MyCheckout page that offers several card products asks the shopper to choose one first (its
+// select-payment-product page: Visa 1, Mastercard 3, Visa Electron 122, and so on). That choice
+// posts to the same /checkout URL with no card, and continues untouched. The card form it opens
+// then looks the typed number's IIN up with Worldline and, when the answer names another product
+// the page offers, switches its own paymentProductId to that product. With the agent's placeholder
+// typed, the answer describes the placeholder, never the card that pays: on 2026-10-12 CLZ's page
+// read the SDK's Visa placeholder (411111) as Visa Electron (122) and switched the form from the
+// Visa (1) the agent chose. The cardholder's device checks only that the product belongs to the
+// real card's network (Visa takes 1, 114 and 122), so it would have submitted a Visa credit card
+// as Visa Electron. The device never sees the choice and the API stores only the card form; this
+// attachment sees both posts, so the SDK holds the card submit to the product chosen for its
+// hosted checkout.
+//
+// The processor ships dark: the API serves the recognizer only to a build that declares
+// `worldline_mycheckout_form`, for an org Agentcard turned Worldline on for. Without it no
+// MyCheckout post pauses, and none reaches this module.
+import { isWorldlineMyCheckoutUrl, parseWorldlineMyCheckoutForm } from './worldline-mycheckout.generated.js';
+/** Whether `url` is one of MyCheckout's four card-form endpoints, written exactly (payment-core's rule). */
+export function isWorldlineMyCheckoutEndpoint(url) {
+    return isWorldlineMyCheckoutUrl(url) === true;
+}
+/** The `blocked` detail for a card submit whose product is not the one its page chose. */
+export const WORLDLINE_MYCHECKOUT_PRODUCT_CHANGED = 'worldline_mycheckout_product_changed';
+/** The `blocked` detail for a card submit that names no product, on a hosted checkout whose page chose one. */
+export const WORLDLINE_MYCHECKOUT_PRODUCT_MISSING = 'worldline_mycheckout_product_missing';
+/** How many hosted checkouts one attachment remembers a choice for; the oldest is forgotten first. */
+const REMEMBERED_CHECKOUTS = 32;
+const PRODUCT_ID = /^\d{1,4}$/;
+/**
+ * The card products one attachment saw chosen, per hosted checkout: its `publicMerchantId` and
+ * `token`, the pair payment-core's duplicate guard reads as one hosted checkout
+ * (WORLDLINE_MYCHECKOUT_DEDUPE).
+ */
+export class WorldlineMyCheckoutProducts {
+    chosen = new Map();
+    /**
+     * Read one POST to a card-form endpoint. A product selection (no card, and neither the Pay nor
+     * the cancel pair) records the product it chose for its hosted checkout, or forgets the choice
+     * when it picks the card group, which leaves the product to the card. A card submit is judged:
+     * WORLDLINE_MYCHECKOUT_PRODUCT_CHANGED when its paymentProductId is another product than the one
+     * chosen for its hosted checkout, WORLDLINE_MYCHECKOUT_PRODUCT_MISSING when it names none. Null for
+     * every other post, and for a card submit on the card group or on a hosted checkout whose choice
+     * this attachment never saw: the API and the device judge those as before. A body payment-core
+     * cannot read is never judged here either.
+     */
+    judge(url, body) {
+        if (typeof body !== 'string' || !isWorldlineMyCheckoutUrl(url))
+            return null;
+        const parsed = parseWorldlineMyCheckoutForm(body);
+        if (!parsed.pairs)
+            return null;
+        const values = new Map();
+        for (const [key, value] of parsed.pairs)
+            if (!values.has(key))
+                values.set(key, value);
+        const merchant = values.get('publicMerchantId');
+        const token = values.get('token');
+        if (!merchant || !token)
+            return null;
+        const checkout = JSON.stringify([merchant, token]);
+        const product = values.get('paymentProductId');
+        // A card is a non-empty cardNumber, as the recognizer's card fields read it (card-fields.js).
+        if (!values.get('cardNumber')) {
+            if (values.has('doPayment') || values.has('cancelPayment'))
+                return null;
+            if (product !== undefined && PRODUCT_ID.test(product))
+                this.remember(checkout, product);
+            else if (values.get('paymentProductGroupId') === 'cards')
+                this.chosen.delete(checkout);
+            return null;
+        }
+        if (values.has('paymentProductGroupId'))
+            return null;
+        const chosen = this.chosen.get(checkout);
+        if (chosen === undefined)
+            return null;
+        if (!product)
+            return WORLDLINE_MYCHECKOUT_PRODUCT_MISSING;
+        return product === chosen ? null : WORLDLINE_MYCHECKOUT_PRODUCT_CHANGED;
+    }
+    remember(checkout, product) {
+        this.chosen.delete(checkout);
+        this.chosen.set(checkout, product);
+        while (this.chosen.size > REMEMBERED_CHECKOUTS)
+            this.chosen.delete(this.chosen.keys().next().value);
+    }
+}

package/dist/wspay.d.ts

@@ -4,27 +4,28 @@ export declare const WSPAY_PSP = "wspay";
 export declare const WSPAY_CAPABILITY = "wspay_confirm";
 /**
  * Why the SDK refuses a WSPay request before anything is claimed, created or prompted:
- *   - `unsupported_wspay_payment_method`: not the card frame's new-card confirm. That covers a
- *     saved_card or temp_card_id body (no new card to fill), a card-shaped object the page
- *     built into the transaction, another URL shape on the host, or headers the frame does not
- *     send. The cardholder's device could never fill it.
- *   - `wspay_keep_on_file_unsupported`: a sound confirm that asks WSPay to keep the card on file
- *     (tokenize_pan true), so the merchant could charge it later without another approval. Only
- *     the cardholder can agree to that, and no approval asks them yet.
- * The API refuses the same requests at create (invalid_wspay_request and
- * wspay_keep_on_file_unsupported), so a refusal here only saves the round trip.
+ * `unsupported_wspay_payment_method`, not the card frame's new-card confirm. That covers a
+ * saved_card or temp_card_id body (no new card to fill), a card-shaped object the page built
+ * into the transaction, another URL shape on the host, or headers the frame does not send. The
+ * cardholder's device could never fill it, and the API refuses the same requests at create
+ * (invalid_wspay_request), so a refusal here only saves the round trip.
+ *
+ * A sound confirm that asks WSPay to keep the card on file (tokenize_pan true) pauses like a
+ * one-time one: the approval that follows asks the cardholder whether the merchant may keep the
+ * card. The API offers it for that approval only as a hotel's EUR 1.00 card guarantee paid with a
+ * card the cardholder stored, and refuses any other at create (wspay_keep_on_file_unsupported,
+ * card_not_stored).
  */
-export type WspayRefusalReason = 'unsupported_wspay_payment_method' | 'wspay_keep_on_file_unsupported';
+export type WspayRefusalReason = 'unsupported_wspay_payment_method';
 /** True when the URL's host is one of WSPay's two Components hosts. */
 export declare function isWspayHost(url: string): boolean;
 /**
  * The pause decision for a POST the registry recognized on a WSPay host. Null when it is the
- * card frame's confirm of a new card for a one-time payment, which pauses for approval;
- * otherwise the reason it is refused. It judges the whole request (the exact URL, the frame's
- * content type, Accept and WP3-v2-Client authorization, and a body of the frame's own keys
- * bound to the URL's client_secret) with payment-core's wspayConfirmRefusal, the check the API
- * runs at create. It never passes keep-on-file consent: that waits for an approval that asks
- * the cardholder.
+ * card frame's confirm of a new card, which pauses for approval; otherwise the reason it is
+ * refused. It judges the whole request (the exact URL, the frame's content type, Accept and
+ * WP3-v2-Client authorization, and a body of the frame's own keys bound to the URL's
+ * client_secret) with payment-core's wspayConfirmRefusal, the check the API runs at create.
+ * It passes keep-on-file consent because the approval that follows asks the cardholder for it.
  */
 export declare function wspayRefusal(request: {
     url: string;