earnrate 0.2.7 → 0.2.8

package/data/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 Every change to card rules, merchants, categories or currencies under `data/`. Bump `data/VERSION` (`YYYY.MM.DD`, plus `.N` for a second release on the same day) and add a section here in the same commit. Each row cites the issuer page the new value came from.
 
+## 2026.11.02.5
+
+Prime Visa's 3% without-Prime rate no longer applies at Whole Foods stores outside the U.S. Chase's terms exclude "purchases made at international Whole Foods Markets" from both the 5% and the 3% rate; only the 5% rule was U.S.-only.
+
+| Card             | Field                     | Old → new                                                              | Source                                                                                             |
+| ---------------- | ------------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
+| chase-prime-visa | amazon-without-prime      | Whole Foods moved to its own rule                                      | [Chase Prime Visa page](https://creditcards.chase.com/cash-back-credit-cards/amazon-prime-rewards) |
+| chase-prime-visa | whole-foods-without-prime | new rule: 3% at Whole Foods without Prime, U.S. only (abroad: 3% → 1%) | [Chase Prime Visa page](https://creditcards.chase.com/cash-back-credit-cards/amazon-prime-rewards) |
+
 ## 2026.11.02.4
 
 Customized Cash's todo about purchases that cross the $2,500 quarterly cap is resolved: past the cap, a BofA Rewards tier's boosted base rate now applies. No rates changed.

package/data/VERSION

@@ -1 +1 @@
-2026.11.02.4
+2026.11.02.5

package/data/cards/chase-prime-visa.yaml

@@ -38,9 +38,14 @@ rules:
     rate: 5
     requires: { membership: amazon-prime }
   - id: amazon-without-prime
-    match: { merchants: [amazon, amazon-fresh, whole-foods, audible] }
+    match: { merchants: [amazon, amazon-fresh, audible] }
     rate: 3
     note: Without an eligible Prime membership these earn 3% instead of 5%.
+  - id: whole-foods-without-prime
+    match: { merchants: [whole-foods] }
+    rate: 3
+    geography: us_only
+    note: Without an eligible Prime membership, Whole Foods earns 3% instead of 5%, in the U.S. only.
   - id: chase-travel
     match: { merchants: [chase-travel] }
     rate: 5
@@ -93,6 +98,12 @@ evidence:
   - rule: amazon-without-prime
     url: https://creditcards.chase.com/cash-back-credit-cards/amazon-prime-rewards
     quote: '3% back without an eligible Prime membership for each $1 of eligible purchases'
+  - rule: whole-foods-without-prime
+    url: https://creditcards.chase.com/cash-back-credit-cards/amazon-prime-rewards
+    quote: '3% back without an eligible Prime membership for each $1 of eligible purchases'
+  - rule: whole-foods-without-prime
+    url: https://creditcards.chase.com/cash-back-credit-cards/amazon-prime-rewards
+    quote: 'purchases made at international Whole Foods Markets'
   - rule: chase-travel
     url: https://creditcards.chase.com/cash-back-credit-cards/amazon-prime-rewards
     quote: '5% back or 3% back through Chase Travel'

package/dist/cli/import.js

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
-import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { readFile } from 'node:fs/promises';
+import { writeFileAtomic } from "../data/atomic-write.js";
 import path from 'node:path';
 import { parseArgs } from 'node:util';
 import { z } from 'zod';
@@ -247,10 +248,7 @@ export async function runImport(argv, io) {
         recorded.add(fingerprint(entry));
     for (const entry of bonusEntries)
         recorded.add(fingerprint(entry, 'bonus'));
-    await mkdir(path.dirname(ledgerFile), { recursive: true });
-    const tmp = `${ledgerFile}.${String(process.pid)}.tmp`;
-    await writeFile(tmp, `${JSON.stringify({ version: 1, recorded: [...recorded] }, null, 2)}\n`);
-    await rename(tmp, ledgerFile);
+    await writeFileAtomic(ledgerFile, `${JSON.stringify({ version: 1, recorded: [...recorded] }, null, 2)}\n`);
     io.stdout(`Recorded ${toRecord.join(' and ')} in ${displayPath(walletFile)}.\n`);
     return 0;
 }

package/dist/data/atomic-write.js

@@ -0,0 +1,13 @@
+import { chmod, mkdir, realpath, rename, stat, writeFile, } from 'node:fs/promises';
+import path from 'node:path';
+// Writes through a symlink rather than replacing it, and keeps the file's
+// mode: a user's chmod 600 must survive every edit.
+export async function writeFileAtomic(file, text) {
+    const target = await realpath(file).catch(() => file);
+    const mode = await stat(target).then((s) => s.mode & 0o777, () => 0o600);
+    await mkdir(path.dirname(target), { recursive: true, mode: 0o700 });
+    const tmp = `${target}.${String(process.pid)}.tmp`;
+    await writeFile(tmp, text, { mode });
+    await chmod(tmp, mode); // writeFile's mode is narrowed by the umask
+    await rename(tmp, target);
+}

package/dist/data/store.js

@@ -1,5 +1,6 @@
 import { bookPurchase } from "../engine/record.js";
 import { addToWallet, removeFromWallet, updateInWallet, withMemberships, withValuations, } from "../engine/wallet-change.js";
+import { withoutCardNumbers } from "../schema/card-number.js";
 import { WALLET_VERSION, WalletSchema } from "../schema/wallet.js";
 const failed = (error) => ({ ok: false, error });
 // Memberships and point values can be saved before any card.
@@ -19,7 +20,9 @@ export class JsonWalletStore {
     }
     async load() {
         const text = await this.backend.read();
-        return text === null ? null : WalletSchema.parse(JSON.parse(text));
+        return text === null
+            ? null
+            : WalletSchema.parse(withoutCardNumbers(JSON.parse(text)));
     }
     serialized(task) {
         const run = this.queue.then(task, task);

package/dist/data/wallet-edit.js

@@ -1,5 +1,5 @@
-import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
-import path from 'node:path';
+import { readFile } from 'node:fs/promises';
+import { writeFileAtomic } from "./atomic-write.js";
 import { isDeepStrictEqual } from 'node:util';
 import { isMap, isSeq, parseDocument, stringify } from 'yaml';
 import { applyBonusBooking, applyBooking, } from "../engine/record.js";
@@ -359,8 +359,5 @@ export async function commitWalletText(file, after, expected, fallback = BY_HAND
     if (!parsed.success || !isDeepStrictEqual(parsed.data, expected)) {
         throw new Error(`couldn't update ${file} safely; ${fallback}`);
     }
-    await mkdir(path.dirname(file), { recursive: true });
-    const tmp = `${file}.${String(process.pid)}.tmp`;
-    await writeFile(tmp, after);
-    await rename(tmp, file);
+    await writeFileAtomic(file, after);
 }

package/dist/engine/recommend.js

@@ -146,6 +146,10 @@ function warningsFor(catalog, entry, purchase) {
         warnings.push(`Your chosen categories are set for ${evaluation.staleChoice}, not the current period, so chosen-category bonuses don't apply until you update them.`);
     }
     for (const rule of evaluation.needsActivation) {
+        if (rule.activate_by !== undefined && rule.activate_by < purchase.date) {
+            warnings.push(`The bonus here (${earnText(catalog, rule.rate, valuation.currency)}) needed activating by ${shortDate(rule.activate_by)}.`);
+            continue;
+        }
         warnings.push(`Activate this bonus with the issuer (it's free)${rule.activate_by === undefined ? '' : ` by ${shortDate(rule.activate_by)}`} to earn ${earnText(catalog, rule.rate, valuation.currency)} here${rule.valid_to === undefined ? '' : ` through ${shortDate(rule.valid_to)}`}.`);
     }
     return warnings;

package/dist/engine/setup.js

@@ -45,6 +45,7 @@ export function activationRules(card, today) {
     return card.rules
         .filter((r) => r.requires?.activation === true &&
         (r.valid_to === undefined || r.valid_to >= today) &&
+        (r.activate_by === undefined || r.activate_by >= today) &&
         (r.valid_from === undefined ||
             daysBetween(today, r.valid_from) <= ACTIVATION_LOOKAHEAD_DAYS))
         .map((r) => r.id);

package/dist/engine/wallet-change.js

@@ -1,3 +1,4 @@
+import { CARD_NUMBER_LABEL, labelHasCardNumber } from "../schema/card-number.js";
 import { WALLET_VERSION, } from "../schema/wallet.js";
 import { addMonths } from "./bonus.js";
 import { capByKey } from "./evaluate.js";
@@ -33,9 +34,8 @@ export function cardFields(card, held, input, today) {
     else if (input.checkoutLabel !== undefined) {
         if (input.checkoutLabel.trim() === '')
             problems.push('The checkout label is empty.');
-        // earnrate never stores card numbers; a last four is fine.
-        if (/\d{8,}/.test(input.checkoutLabel.replace(/[\s-]/g, '')))
-            problems.push('The checkout label looks like it has a card number in it. earnrate never stores card numbers; use a name like "Amex Gold".');
+        if (labelHasCardNumber(input.checkoutLabel))
+            problems.push(CARD_NUMBER_LABEL);
         fields.checkout_label = input.checkoutLabel.trim();
     }
     if (input.anniversary !== undefined) {

package/dist/format/wallet-yaml.js

@@ -1,5 +1,6 @@
 import { Document, parse, visit } from 'yaml';
 import { walletProblems } from "../data/integrity.js";
+import { CARD_NUMBER_LABEL, CARD_NUMBER_REDEMPTION, } from "../schema/card-number.js";
 import { WALLET_VERSION, WalletSchema } from "../schema/wallet.js";
 // A wallet as the YAML file the CLI reads, for moving it between the
 // website, the remote server and the command line. Node-free.
@@ -54,7 +55,10 @@ export function parseWalletYaml(text, catalog) {
     }
     const result = WalletSchema.safeParse(raw);
     if (!result.success)
-        return "That isn't an earnrate wallet.";
+        return (result.error.issues
+            .map((i) => i.message)
+            .find((m) => m === CARD_NUMBER_LABEL || m === CARD_NUMBER_REDEMPTION) ??
+            "That isn't an earnrate wallet.");
     const problems = walletProblems(result.data, catalog);
     return problems.length > 0 ? problems.join(' ') : result.data;
 }

package/dist/merchants/cache.js

@@ -1,4 +1,5 @@
-import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { readFile } from 'node:fs/promises';
+import { writeFileAtomic } from "../data/atomic-write.js";
 import { homedir } from 'node:os';
 import path from 'node:path';
 import { z } from 'zod';
@@ -71,10 +72,7 @@ export async function openMerchantCache(file) {
                 merchants = { ...merchants, [key]: toEntry(value) };
                 if (!writable)
                     return;
-                await mkdir(path.dirname(file), { recursive: true });
-                const tmp = `${file}.${String(process.pid)}.tmp`;
-                await writeFile(tmp, `${JSON.stringify({ version: 1, merchants }, null, 2)}\n`);
-                await rename(tmp, file);
+                await writeFileAtomic(file, `${JSON.stringify({ version: 1, merchants }, null, 2)}\n`);
             },
         },
     };

package/dist/merchants/fallback.js

@@ -1,4 +1,5 @@
 import { LLM_MAX_CALLS_ENV_VAR } from "../brand.js";
+import { hasCardNumber } from "../schema/card-number.js";
 import { describeClassifierError } from "./anthropic.js";
 import { normalizeMerchantName, resolveMerchant } from "./resolve.js";
 export const DEFAULT_MAX_CALLS = 20;
@@ -42,6 +43,13 @@ export function createLlmSession(options) {
             const known = resolveMerchant(catalog, input, channel);
             if (known.source !== 'none')
                 return { merchant: known, notices: [] };
+            if (hasCardNumber(input))
+                return {
+                    merchant: known,
+                    notices: [
+                        'Skipped the Claude lookup: that looks like a card number, and earnrate never sends one anywhere.',
+                    ],
+                };
             const key = normalizeMerchantName(input);
             const saved = options.cache.get(key);
             if (saved && usable(catalog, saved)) {

package/dist/merchants/missed.js

@@ -1,8 +1,10 @@
-import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { readFile } from 'node:fs/promises';
+import { writeFileAtomic } from "../data/atomic-write.js";
 import { homedir } from 'node:os';
 import path from 'node:path';
 import { z } from 'zod';
 import { CONFIG_DIR, MISSED_ENV_VAR } from "../brand.js";
+import { hasCardNumber } from "../schema/card-number.js";
 import { normalizeMerchantName } from "./resolve.js";
 const MissedFileSchema = z.object({
     version: z.literal(1),
@@ -37,7 +39,7 @@ export function missLogAt(file) {
     return {
         note(name, category, today) {
             const key = normalizeMerchantName(name);
-            if (key === '')
+            if (key === '' || hasCardNumber(name))
                 return Promise.resolve();
             const run = queue.then(async () => {
                 let merchants = {};
@@ -66,10 +68,7 @@ export function missLogAt(file) {
                 const kept = Object.entries(merchants)
                     .sort(([, a], [, b]) => b.last_seen.localeCompare(a.last_seen))
                     .slice(0, MAX);
-                await mkdir(path.dirname(file), { recursive: true });
-                const tmp = `${file}.${String(process.pid)}.tmp`;
-                await writeFile(tmp, `${JSON.stringify({ version: 1, merchants: Object.fromEntries(kept) }, null, 2)}\n`);
-                await rename(tmp, file);
+                await writeFileAtomic(file, `${JSON.stringify({ version: 1, merchants: Object.fromEntries(kept) }, null, 2)}\n`);
             });
             queue = run.catch(() => undefined);
             return run.catch(() => undefined);

package/dist/schema/card-number.js

@@ -0,0 +1,31 @@
+// earnrate never stores card numbers, on any surface. A card number is 13 to
+// 19 digits; a phone number in a store's name is 10 or 11, so free text with
+// a longer run is refused or not kept.
+const digitsOnly = (text) => text.replace(/[\s.-]/g, '');
+export const hasCardNumber = (text) => /\d{13,}/.test(digitsOnly(text));
+// A checkout label may carry a last four, but never 8 or more digits.
+export const labelHasCardNumber = (text) => /\d{8,}/.test(digitsOnly(text));
+export const CARD_NUMBER_LABEL = 'The checkout label looks like it has a card number in it. earnrate never stores card numbers; use a name like "Amex Gold".';
+export const CARD_NUMBER_REDEMPTION = 'The redemption note looks like it has a card number in it. earnrate never stores card numbers.';
+// For wallets saved before the schema refused card numbers: drop the field
+// instead of failing to load, since a wallet that can't load can't be fixed.
+export function withoutCardNumbers(raw) {
+    if (!isRecord(raw))
+        return raw;
+    const wallet = { ...raw };
+    if (Array.isArray(wallet.cards))
+        wallet.cards = wallet.cards.map((card) => isRecord(card) && isCardNumber(card.checkout_label, labelHasCardNumber)
+            ? omit(card, 'checkout_label')
+            : card);
+    if (isRecord(wallet.valuations))
+        wallet.valuations = Object.fromEntries(Object.entries(wallet.valuations).map(([currency, value]) => [
+            currency,
+            isRecord(value) && isCardNumber(value.redemption, hasCardNumber)
+                ? omit(value, 'redemption')
+                : value,
+        ]));
+    return wallet;
+}
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const isCardNumber = (value, test) => typeof value === 'string' && test(value);
+const omit = (record, key) => Object.fromEntries(Object.entries(record).filter(([k]) => k !== key));

package/dist/schema/wallet.js

@@ -1,11 +1,15 @@
 import { z } from 'zod';
 import { CurrencyId, IsoDate, KebabId, PeriodKey, ValueRange, } from "./common.js";
+import { CARD_NUMBER_LABEL, CARD_NUMBER_REDEMPTION, hasCardNumber, labelHasCardNumber, } from "./card-number.js";
 const Valuation = z.union([
     z.number().positive(),
     z.strictObject({
         value: z.number().positive().optional(),
         range: ValueRange.optional(),
-        redemption: z.string().optional(),
+        redemption: z
+            .string()
+            .refine((t) => !hasCardNumber(t), CARD_NUMBER_REDEMPTION)
+            .optional(),
     }),
 ]);
 const CapUsage = z.strictObject({
@@ -14,7 +18,11 @@ const CapUsage = z.strictObject({
 });
 export const WalletCardSchema = z.strictObject({
     id: KebabId,
-    checkout_label: z.string().min(1).optional(),
+    checkout_label: z
+        .string()
+        .min(1)
+        .refine((t) => !labelHasCardNumber(t), CARD_NUMBER_LABEL)
+        .optional(),
     // MM-DD, needed only for cardmember_year caps.
     anniversary: z
         .string()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "earnrate",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "description": "Which credit card earns the most at a merchant, from your cards or every card, and why",
   "keywords": [
     "credit cards",