Update payment metadata and restore Docker test baseline

AGENTS.md

@@ -0,0 +1,18 @@
+# Repo Working Notes
+
+## Test And Debugging Baseline
+
+- Use Docker/Linux for installs, builds, and tests by default.
+- Treat the CI environment as the source of truth:
+  - Ubuntu/Linux
+  - Node 24
+  - `npm ci`
+  - `npm test`
+- Do not spend time fixing Windows-only runtime or dependency issues unless explicitly requested.
+- Do not commit repo changes whose only purpose is to make local Windows execution work.
+- If a failure appears only in the local Windows shell, do not treat it as a code regression until it reproduces in Docker/Linux.
+
+## Current Project Preference
+
+- For this fork, validate payment-related changes through the Docker-based workflow before judging safety to commit.
+- When Docker is unavailable, fix Docker availability first rather than switching to Windows-specific debugging.

PAYMENT_SIM_RECIPES.md

@@ -1,53 +0,0 @@
-# Payment Simulation Recipe Candidates
-
-This list targets software-only development and testing environments.
-
-## Frame And Transport Simulation
-1. Length-prefix builder/parser pairs for command and response replay.
-2. Status code mutation recipes (success/error branch testing).
-3. Header-length fuzzing recipes for parser hardening.
-
-## TR-31 Simulation
-1. Header mutation recipes (usage, mode, exportability, optional block counts).
-2. Optional-block truncation and malformed-length negative tests.
-3. Prefix-normalization recipes (`R` prefix handling).
-4. Create TR-31 key block recipes for symmetric test keys and round-trip parse validation.
-
-## TR-34 Simulation
-1. Envelope section split/rebuild recipes.
-2. ASN.1 length corruption tests.
-3. Signature-length mismatch recipes.
-
-## KCV And Key Lifecycle Simulation
-1. KCV cross-check recipes across TDES, AES-CMAC, and HMAC methods.
-2. Variant-mask simulation for derived key classes.
-3. Deterministic fixed-vector recipes for regression checks.
-
-## ECDH Simulation
-1. Static keypair handshake vectors.
-2. Shared-info permutations in Concat KDF.
-3. Curve mismatch and malformed key negative tests.
-
-## DUKPT Simulation
-1. IPEK derivation from known BDK/KSN vectors.
-2. Counter progression replay across KSN ranges.
-3. Variant-mask output sets for transaction classes.
-
-## EMV/Scheme-Level Candidate Recipes
-1. ARQC generation checks for AES-CMAC profiles with fixed session keys and known CDOL payloads.
-2. ARPC generation checks for AES-CMAC response profiles with explicit ARC/CSU/proprietary-data assembly.
-3. Tag concatenation and canonical ordering checks.
-4. Session derivation input normalization checks.
-5. Cryptogram preimage assembly validation recipes.
-6. PAN parser and network classifier recipes for Visa (`4`, typically 13/16/19 digits), Mastercard (`51`-`55`, `2221`-`2720`, 16 digits), American Express (`34`, `37`, 15 digits), and Discover (`6011`, `644`-`649`, `65`, and `622126`-`622925`, typically 16-19 digits), including Luhn validation and issuer-range explanation.
-Status:
-`Generate Test PAN` and `Parse PAN` are now implemented. Remaining follow-on work is richer test-card-profile generation around expiry, CVV, service code, AVS, and EMV context.
-
-## AWS Payment Cryptography Candidate Recipes
-1. `EncryptData` and `DecryptData` parity vectors for AES, TDES, and RSA.
-2. `ReEncryptData` parity vectors for decrypt-then-encrypt workflows.
-3. `GenerateMac` and `VerifyMac` parity vectors across HMAC, CMAC, ISO9797, DUKPT, AS2805, and EMV MAC profiles.
-4. `VerifyAuthRequestCryptogram` preimage-validation recipes for the implemented AES-CMAC EMV profiles.
-5. DUKPT derivation-plus-cipher recipes for AWS derived-key lab testing.
-6. ECDH plus wrap/unwrap plus TR-31 inspection recipes for `TranslateKeyMaterial` interoperability debugging.
-7. Remaining gap-tracking recipes for encrypted PIN translation, richer EMV session derivation, and fuller TR-31/TR-34 generation flows.

UPSTREAM_PR_DRAFT.md

@@ -1,76 +0,0 @@
-# Upstream PR Draft
-
-Upstream compare URL:
-
-`https://github.com/gchq/CyberChef/compare/master...J8k3:master?expand=1`
-
-Suggested PR title:
-
-`Add payment cryptography emulation operations, recipes, and validation guardrails`
-
-Suggested PR body:
-
-```md
-## Summary
-
-This PR adds a payment-focused extension surface to CyberChef for software emulation, testing, interoperability work, and education.
-
-It is intentionally documented as software-only tooling rather than a certified HSM or production key-custody surface.
-
-## What This Adds
-
-- A new `Payments` category with payment-facing operations for:
-  - data encryption / decryption / re-encryption
-  - MAC generation / verification
-  - EMV ARQC / ARPC / MAC helpers
-  - clear PIN block build / parse / translate
-  - card validation data
-  - DUKPT / ECDH / KCV helpers
-  - test PAN generation / parsing
-  - TR-31 / TR-34 inspection helpers
-- Payment recipe and chaining docs:
-  - `PAYMENT_RECIPES.md`
-  - `AWS_PAYMENT_CRYPTOGRAPHY_RECIPES.md`
-  - `PAYMENT_SIM_RECIPES.md`
-- A validation audit with explicit guardrails:
-  - `PAYMENT_VALIDATION_AUDIT.md`
-- UI improvements for payment operations:
-  - inline recipe-card guidance
-  - visible validation / scope / security wording
-  - built-in test-data population helpers
-
-## Validation / Guardrails
-
-The payment operations are explicitly classified in `PAYMENT_VALIDATION_AUDIT.md` as:
-- verified against public standards / vectors
-- vendor-aligned
-- externally cross-checked
-- emulation helpers
-
-That status is also surfaced inline on higher-risk operations so users can see scope and limitations in the recipe UI.
-
-## Scope Notes
-
-- Intended for software emulation, QA, interoperability, and educational use.
-- Not a certified HSM implementation.
-- Not presented as a PCI-scoped production key-custody surface.
-
-## Verification
-
-- Docker build completed successfully from this branch.
-- Payment-focused vectors and operation tests were added/expanded in `tests/operations/tests/Payment.mjs`.
-- Common recipe chains are documented explicitly in the payment docs.
-
-## If This Is Too Broad
-
-If maintainers would prefer smaller review units, I can split this into follow-up PRs by:
-1. payment primitives and category plumbing
-2. MAC / KCV / DUKPT / ECDH / PIN block operations
-3. EMV / card-validation / issuer-verification helpers
-4. test-data generators, docs, and validation guardrails
-```
-
-Submission notes:
-- Upstream `gchq/CyberChef` currently uses `master` as the default branch.
-- On first submission, GitHub will prompt you to sign the GCHQ CLA:
-  - https://github.com/gchq/CyberChef

src/core/operations/DecryptPaymentData.mjs

@@ -27,7 +27,7 @@ class DecryptPaymentData extends Operation {
                 args: ["AES CBC", "00112233445566778899AABBCCDDEEFF", "000102030405060708090A0B0C0D0E0F", "", "Data", false]
             }
         ];
-        this.infoURL = "https://docs.aws.amazon.com/payment-cryptography/latest/DataAPIReference/API_DecryptData.html";
+        this.infoURL = "https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation";
         this.inputType = "string";
         this.outputType = "string";
         this.args = [

src/core/operations/DeriveDUKPTKey.mjs

@@ -198,7 +198,7 @@ class DeriveDUKPTKey extends Operation {
 
         this.name = "Derive DUKPT Key";
         this.module = "Payment";
-        this.description = "Paste the Base Derivation Key (BDK) into the input field as a 16-byte hex value.<br><br>Put the 10-byte Key Serial Number in the <b>KSN</b> argument field.<br><br><b>Input:</b> BDK in hex.<br><b>Arguments:</b> choose whether to derive the IPEK or the transaction key, provide the KSN, choose the variant, and optionally return JSON.<br><br>This operation derives TDES DUKPT keys in software for test and interoperability work.";
+        this.description = "Paste the Base Derivation Key (BDK) into the input field as a 16-byte hex value.<br><br>Put the 10-byte Key Serial Number in the <b>KSN</b> argument field.<br><br><b>Input:</b> BDK in hex.<br><b>Arguments:</b> choose whether to derive the IPEK or the transaction key, provide the KSN, choose the variant, and optionally return JSON.<br><br>This operation derives TDES DUKPT keys (ANSI X9.24 Part 1) in software for test and interoperability work. It uses a 16-byte BDK and a 10-byte KSN. AES DUKPT (ANSI X9.24 Part 3), which uses a 12-byte KSN and AES keys, is not implemented here.";
         this.inlineHelp = "<strong>Input:</strong> BDK hex.<br><strong>Args:</strong> add the KSN, choose IPEK or transaction-key derivation, then optionally apply a variant.";
         this.testDataSamples = [
             {
@@ -215,13 +215,13 @@ class DeriveDUKPTKey extends Operation {
                 "name": "Mode",
                 "type": "option",
                 "value": ["Derive IPEK", "Derive Session Key"],
-                "comment": "Choose whether the output should be the IPEK or the derived transaction/session key. Assumption: this implementation follows TDES DUKPT, not AES DUKPT."
+                "comment": "Choose whether the output should be the IPEK or the derived transaction/session key. Assumption: this implementation follows TDES DUKPT (ANSI X9.24 Part 1), not AES DUKPT (ANSI X9.24 Part 3)."
             },
             {
                 "name": "KSN (hex, 10 bytes)",
                 "type": "string",
                 "value": "",
-                "comment": "Provide the full 10-byte KSN as 20 hex characters, for example <code>FFFF9876543210E00008</code>. Spaces are allowed."
+                "comment": "Provide the full 10-byte KSN as 20 hex characters, for example <code>FFFF9876543210E00008</code>. Spaces are allowed. Note: AES DUKPT uses a 12-byte KSN — this operation only accepts 10-byte TDES DUKPT KSNs."
             },
             {
                 "name": "Session key variant",

src/core/operations/EncryptPaymentData.mjs

@@ -27,7 +27,7 @@ class EncryptPaymentData extends Operation {
                 args: ["AES CBC", "00112233445566778899AABBCCDDEEFF", "000102030405060708090A0B0C0D0E0F", "", "Data", false]
             }
         ];
-        this.infoURL = "https://docs.aws.amazon.com/payment-cryptography/latest/DataAPIReference/API_EncryptData.html";
+        this.infoURL = "https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation";
         this.inputType = "string";
         this.outputType = "string";
         this.args = [

src/core/operations/GenerateAS2805KEKValidation.mjs

@@ -58,13 +58,13 @@ class GenerateAS2805KEKValidation extends Operation {
                 args: ["KekValidationRequest", "TDES_2KEY", "VARIANT_MASK_82", "", true]
             }
         ];
-        this.infoURL = "https://docs.aws.amazon.com/payment-cryptography/latest/DataAPIReference/API_GenerateAs2805KekValidation.html";
+        this.infoURL = "https://en.wikipedia.org/wiki/AS2805";
         this.inputType = "string";
         this.outputType = "string";
         this.args = [
             { name: "Validation type", type: "option", value: ["KekValidationRequest", "KekValidationResponse"], comment: "Request mode creates a fresh RandomKeySend. Response mode derives RandomKeyReceive from the supplied RandomKeySend." },
             { name: "Derive key algorithm", type: "option", value: ["TDES_2KEY", "TDES_3KEY"], comment: "Controls whether RandomKeySend / RandomKeyReceive are 16 bytes or 24 bytes long." },
-            { name: "RandomKeySend variant mask", type: "option", value: ["VARIANT_MASK_82", "VARIANT_MASK_82C0"], comment: "AWS surfaces this as metadata for AS2805 KEK validation. This emulation reports the selected label but does not model HSM-side key custody." },
+            { name: "RandomKeySend variant mask", type: "option", value: ["VARIANT_MASK_82", "VARIANT_MASK_82C0"], comment: "Variant mask label used during AS2805 KEK validation. This emulation reports the selected label but does not model HSM-side key custody." },
             { name: "RandomKeySend (response only)", type: "string", value: "", comment: "Required only in response mode. Provide the incoming RandomKeySend hex value from the partner node." },
             { name: "Output as JSON", type: "boolean", value: true, comment: "When enabled, returns the KEK KCV and both RandomKeySend / RandomKeyReceive values." },
         ];

src/core/operations/GenerateCardValidationData.mjs

@@ -28,7 +28,7 @@ class GenerateCardValidationData extends Operation {
                 args: ["CVV2 / CVC2 (force 000)", "4123456789012345", "02", "25", "MMYY", "101", 3, false]
             }
         ];
-        this.infoURL = "https://docs.aws.amazon.com/payment-cryptography/latest/userguide/generate-card-data.html";
+        this.infoURL = "https://en.wikipedia.org/wiki/Card_security_code";
         this.inputType = "string";
         this.outputType = "string";
         this.args = [

src/core/operations/GenerateEMVARPC.mjs

@@ -19,7 +19,7 @@ class GenerateEMVARPC extends Operation {
 
         this.name = "Generate EMV ARPC";
         this.module = "Payment";
-        this.description = "Paste the already-assembled EMV authorization-response input into the input field as hex and generate an AES-CMAC-based ARPC.<br><br><b>Input:</b> preassembled ARPC input data as hex.<br><b>Arguments:</b> provide the issuer session key in hex and choose how many bytes of the CMAC should be returned.<br><br><b>Validation:</b> Partially verified. This intentionally covers only supplied-key AES-CMAC-style EMV response profiles and does not derive issuer session keys or assemble response fields for you.<br><br><b>Security:</b> Clear session keys are test-use only.";
+        this.description = "Paste the already-assembled EMV authorization-response input into the input field as hex and generate an AES-CMAC-based ARPC.<br><br><b>Input:</b> preassembled ARPC input data as hex.<br><b>Arguments:</b> provide the issuer session key in hex and choose how many bytes of the CMAC should be returned.<br><br><b>Validation:</b> Partially verified. This intentionally covers only supplied-key AES-CMAC-style EMV response profiles and does not derive issuer session keys or assemble response fields for you.<br><br><b>Session key derivation:</b> The issuer session key for ARPC generation is typically derived from the same issuer master key used for ARQC verification, using the same ATC-based derivation. The ARPC input data is assembled from the ARQC value and the Authorization Response Code (ARC). This operation expects both the session key and the preimage to be assembled before calling it.<br><br><b>Security:</b> Clear session keys are test-use only.";
         this.inlineHelp = "<strong>Input:</strong> preassembled ARPC data as hex.<br><strong>Args:</strong> provide the issuer AES session key and choose the truncated cryptogram length.<br><strong>Validation:</strong> supplied-key AES-CMAC response profile only.";
         this.testDataSamples = [
             {
@@ -28,7 +28,7 @@ class GenerateEMVARPC extends Operation {
                 args: ["00112233445566778899AABBCCDDEEFF", 8, false]
             }
         ];
-        this.infoURL = "https://docs.aws.amazon.com/payment-cryptography/latest/userguide/crypto-ops-carddata.html";
+        this.infoURL = "https://en.wikipedia.org/wiki/EMV";
         this.inputType = "string";
         this.outputType = "string";
         this.args = [

src/core/operations/GenerateEMVARQC.mjs

@@ -19,7 +19,7 @@ class GenerateEMVARQC extends Operation {
 
         this.name = "Generate EMV ARQC";
         this.module = "Payment";
-        this.description = "Paste the already-assembled EMV authorization-request input into the input field as hex and generate an AES-CMAC-based ARQC.<br><br><b>Input:</b> preassembled ARQC input data as hex.<br><b>Arguments:</b> provide the EMV session key in hex and choose how many bytes of the CMAC should be returned.<br><br><b>Validation:</b> Partially verified. This intentionally covers only supplied-key AES-CMAC-style EMV profiles and does not derive EMV session keys or assemble CDOL data for you.<br><br><b>Security:</b> Clear session keys are test-use only.";
+        this.description = "Paste the already-assembled EMV authorization-request input into the input field as hex and generate an AES-CMAC-based ARQC.<br><br><b>Input:</b> preassembled ARQC input data as hex.<br><b>Arguments:</b> provide the EMV session key in hex and choose how many bytes of the CMAC should be returned.<br><br><b>Validation:</b> Partially verified. This intentionally covers only supplied-key AES-CMAC-style EMV profiles and does not derive EMV session keys or assemble CDOL data for you.<br><br><b>Session key derivation:</b> In a full EMV flow the session key is derived from the issuer master key using the Application Transaction Counter (ATC) and PAN sequence number. Visa and Amex use EMV Common Session Key Derivation (sometimes called Option A); Mastercard uses a different derivation (Option B). This operation expects you to supply the already-derived session key — use a separate key-derivation step before calling this operation if you need to reproduce a full end-to-end flow.<br><br><b>Security:</b> Clear session keys are test-use only.";
         this.inlineHelp = "<strong>Input:</strong> preassembled ARQC data as hex.<br><strong>Args:</strong> provide the AES session key and choose the truncated cryptogram length.<br><strong>Validation:</strong> supplied-key AES-CMAC profile only.";
         this.testDataSamples = [
             {
@@ -28,7 +28,7 @@ class GenerateEMVARQC extends Operation {
                 args: ["00112233445566778899AABBCCDDEEFF", 8, false]
             }
         ];
-        this.infoURL = "https://docs.aws.amazon.com/payment-cryptography/latest/userguide/crypto-ops-carddata.html";
+        this.infoURL = "https://en.wikipedia.org/wiki/EMV";
         this.inputType = "string";
         this.outputType = "string";
         this.args = [

src/core/operations/GenerateEMVMAC.mjs

@@ -18,7 +18,7 @@ class GenerateEMVMAC extends Operation {
 
         this.name = "Generate EMV MAC";
         this.module = "Payment";
-        this.description = "Paste the issuer-script or EMV command payload into the input field as hex and generate an EMV MAC.<br><br><b>Input:</b> message data as hex.<br><b>Arguments:</b> provide the already-derived EMV session integrity key and choose how many leftmost MAC bytes to return.<br><br><b>Validation:</b> Partially verified. This implements a retail-MAC style EMV helper with a supplied session key, not full EMV session derivation or brand-specific issuer processing.<br><br><b>Security:</b> Clear session keys in the recipe are test-use only.";
+        this.description = "Paste the issuer-script or EMV command payload into the input field as hex and generate an EMV MAC.<br><br><b>Input:</b> message data as hex.<br><b>Arguments:</b> provide the already-derived EMV session integrity key and choose how many leftmost MAC bytes to return.<br><br><b>Validation:</b> Partially verified. This implements a retail-MAC style EMV helper with a supplied session key, not full EMV session derivation or brand-specific issuer processing.<br><br><b>Key context:</b> In a full issuer implementation, the session integrity key used here corresponds to the secure-messaging integrity key (distinct from the confidentiality key used to encrypt data and the PIN encryption key used for PIN blocks). This operation accepts any key you supply and does not enforce that separation.<br><br><b>Security:</b> Clear session keys in the recipe are test-use only.";
         this.inlineHelp = "<strong>Input:</strong> issuer-script message data as hex.<br><strong>Args:</strong> provide the derived EMV session integrity key.<br><strong>Validation:</strong> supplied-key EMV MAC helper, not full EMV derivation.";
         this.testDataSamples = [
             {
@@ -27,7 +27,7 @@ class GenerateEMVMAC extends Operation {
                 args: ["0123456789ABCDEFFEDCBA9876543210", 8, false]
             }
         ];
-        this.infoURL = "https://docs.aws.amazon.com/payment-cryptography/latest/userguide/use-cases-issuers.generalfunctions.emvmac.html";
+        this.infoURL = "https://en.wikipedia.org/wiki/EMV";
         this.inputType = "string";
         this.outputType = "string";
         this.args = [

src/core/operations/GenerateEMVMACForPINChange.mjs

@@ -18,7 +18,7 @@ class GenerateEMVMACForPINChange extends Operation {
 
         this.name = "Generate EMV MAC For PIN Change";
         this.module = "Payment";
-        this.description = "Paste the issuer-script APDU command into the input field as hex and generate the MAC for an offline EMV PIN-change script.<br><br><b>Input:</b> issuer-script message data as hex.<br><b>Arguments:</b> provide the already-encrypted target PIN block in hex and the already-derived EMV session integrity key.<br><br><b>Validation:</b> Emulation helper. The new PIN block must already be encrypted, and this op appends it to the supplied message before applying the same supplied-key EMV MAC profile used elsewhere in this fork.<br><br><b>Security:</b> Test-only issuer-script assembly with clear session keys in the recipe.";
+        this.description = "Paste the issuer-script APDU command into the input field as hex and generate the MAC for an offline EMV PIN-change script.<br><br><b>Input:</b> issuer-script message data as hex.<br><b>Arguments:</b> provide the already-encrypted target PIN block in hex and the already-derived EMV session integrity key.<br><br><b>Validation:</b> Emulation helper. The new PIN block must already be encrypted, and this op appends it to the supplied message before applying the same supplied-key EMV MAC profile used elsewhere in this fork.<br><br><b>Key context:</b> In a full issuer implementation, a PIN-change script involves three distinct keys: a secure-messaging integrity key (for the MAC), a secure-messaging confidentiality key (for encrypting the script data), and a PIN encryption key (for the new PIN block). This operation accepts a single session integrity key and a pre-encrypted PIN block — it does not model the full three-key separation.<br><br><b>Security:</b> Test-only issuer-script assembly with clear session keys in the recipe.";
         this.inlineHelp = "<strong>Input:</strong> issuer-script APDU message as hex.<br><strong>Args:</strong> provide the encrypted target PIN block and derived EMV integrity key.<br><strong>Validation:</strong> emulation helper for PIN-change script MAC assembly.";
         this.testDataSamples = [
             {
@@ -27,7 +27,7 @@ class GenerateEMVMACForPINChange extends Operation {
                 args: ["67FB27C75580EFE7", "0123456789ABCDEFFEDCBA9876543210", 8, false]
             }
         ];
-        this.infoURL = "https://docs.aws.amazon.com/payment-cryptography/latest/userguide/use-cases-issuers.generalfunctions.emvpinchange.html";
+        this.infoURL = "https://en.wikipedia.org/wiki/EMV";
         this.inputType = "string";
         this.outputType = "string";
         this.args = [

src/core/operations/GenerateIBM3624PINOffset.mjs

@@ -18,7 +18,7 @@ class GenerateIBM3624PINOffset extends Operation {
 
         this.name = "Generate IBM 3624 PIN Offset";
         this.module = "Payment";
-        this.description = "Paste the clear PIN into the input field and generate the IBM 3624 offset used by issuer-side PIN verification.<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> provide the clear PVK in hex, decimalization table, validation data, and pad character.<br><br><b>Validation:</b> Partially verified. Parameter shapes align with vendor-style and AWS-style IBM 3624 terminology, but this remains a clear-key software implementation rather than HSM-certified behavior.<br><br><b>Security:</b> Clear PIN and PVK material are test-use only.";
+        this.description = "Paste the clear PIN into the input field and generate the IBM 3624 offset used by issuer-side PIN verification.<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> provide the clear PVK in hex, decimalization table, validation data, and pad character.<br><br><b>Validation:</b> Partially verified. This is a clear-key software implementation of the IBM 3624 PIN offset scheme rather than HSM-certified behavior.<br><br><b>Security:</b> Clear PIN and PVK material are test-use only.";
         this.inlineHelp = "<strong>Input:</strong> clear PIN digits.<br><strong>Args:</strong> provide PVK, decimalization table, validation data, and pad character.<br><strong>Validation:</strong> clear-key IBM 3624 helper.";
         this.testDataSamples = [
             {
@@ -27,7 +27,7 @@ class GenerateIBM3624PINOffset extends Operation {
                 args: ["0123456789ABCDEFFEDCBA9876543210", "0123456789012345", "5432101234567890", "F", true]
             }
         ];
-        this.infoURL = "https://docs.aws.amazon.com/payment-cryptography/latest/userguide/generate-ibm3624.html";
+        this.infoURL = "https://en.wikipedia.org/wiki/IBM_3624";
         this.inputType = "string";
         this.outputType = "string";
         this.args = [

src/core/operations/GeneratePaymentMAC.mjs

@@ -28,7 +28,7 @@ class GeneratePaymentMAC extends Operation {
                 args: ["Hex", "AES-CMAC", "00112233445566778899AABBCCDDEEFF", "Hex", "", "Method 1", 8, false]
             }
         ];
-        this.infoURL = "https://docs.aws.amazon.com/payment-cryptography/latest/DataAPIReference/API_GenerateMac.html";
+        this.infoURL = "https://en.wikipedia.org/wiki/Message_authentication_code";
         this.inputType = "string";
         this.outputType = "string";
         this.args = [
@@ -42,7 +42,7 @@ class GeneratePaymentMAC extends Operation {
                 name: "MAC method",
                 type: "option",
                 value: PAYMENT_MAC_METHODS,
-                comment: "Static-key HMAC and CMAC modes reuse the existing generic primitives. ISO9797 and AS2805 modes apply TDES-based payment MAC logic. DUKPT modes derive a TDES session key first."
+                comment: "Static-key HMAC and CMAC modes reuse the existing generic primitives. ISO9797 and AS2805 modes apply TDES-based payment MAC logic. DUKPT modes derive a TDES session key first. Note: ISO 9797-1 Algorithm 1 and Algorithm 3 are legacy MAC profiles — prefer AES-CMAC for new implementations."
             },
             {
                 name: "Key / BDK",

src/core/operations/GeneratePaymentPINData.mjs

@@ -18,7 +18,7 @@ class GeneratePaymentPINData extends Operation {
 
         this.name = "Generate Payment PIN Data";
         this.module = "Payment";
-        this.description = "Paste the clear PIN into the input field and generate clear PIN-block test data using an AWS-style payment wrapper.<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> choose the PIN-block format, provide the PAN when required, and optionally return structured JSON.<br><br><b>Validation:</b> Partially verified. This wrapper currently covers clear ISO 9564 formats 0, 1, and 3 only.<br><br><b>Security:</b> Clear PIN handling is test-use only.";
+        this.description = "Paste the clear PIN into the input field and generate clear PIN-block test data.<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> choose the PIN-block format, provide the PAN when required, and optionally return structured JSON.<br><br><b>Validation:</b> Partially verified. This wrapper currently covers clear ISO 9564 formats 0, 1, and 3 only.<br><br><b>Security:</b> Clear PIN handling is test-use only.";
         this.inlineHelp = "<strong>Input:</strong> clear PIN digits.<br><strong>Args:</strong> choose the block format and provide the PAN for PAN-bound formats.<br><strong>Validation:</strong> clear ISO formats 0, 1, and 3 only.";
         this.testDataSamples = [
             {
@@ -27,7 +27,7 @@ class GeneratePaymentPINData extends Operation {
                 args: ["ISO Format 0", "5432101234567890", false, false]
             }
         ];
-        this.infoURL = "https://docs.aws.amazon.com/payment-cryptography/latest/DataAPIReference/API_GeneratePinData.html";
+        this.infoURL = "https://wikipedia.org/wiki/ISO_9564";
         this.inputType = "string";
         this.outputType = "string";
         this.args = [

src/core/operations/GenerateVISAPVV.mjs

@@ -27,7 +27,7 @@ class GenerateVISAPVV extends Operation {
                 args: ["0123456789ABCDEFFEDCBA9876543210", "5432101234567890", 1, true]
             }
         ];
-        this.infoURL = "https://docs.aws.amazon.com/payment-cryptography/latest/DataAPIReference/API_VisaPinVerification.html";
+        this.infoURL = "https://en.wikipedia.org/wiki/ISO_9564";
         this.inputType = "string";
         this.outputType = "string";
         this.args = [

src/core/operations/ReEncryptPaymentData.mjs

@@ -27,7 +27,7 @@ class ReEncryptPaymentData extends Operation {
                 args: ["AES CBC", "00112233445566778899AABBCCDDEEFF", "000102030405060708090A0B0C0D0E0F", "", "Data", "TDES CBC", "0123456789ABCDEFFEDCBA9876543210", "1234567890ABCDEF", "", "Data", false]
             }
         ];
-        this.infoURL = "https://docs.aws.amazon.com/payment-cryptography/latest/DataAPIReference/API_ReEncryptData.html";
+        this.infoURL = "https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation";
         this.inputType = "string";
         this.outputType = "string";
         this.args = [

src/core/operations/TranslatePINBlock.mjs

@@ -19,7 +19,7 @@ class TranslatePINBlock extends Operation {
 
         this.name = "Translate PIN Block";
         this.module = "Payment";
-        this.description = "Paste a clear ISO 9564 PIN block into the input field as hex and translate it between supported clear block formats.<br><br><b>Input:</b> 8-byte clear PIN block as hex.<br><b>Arguments:</b> choose the source and target formats, provide source and target PAN values when required, and optionally randomize target filler digits for formats 1 and 3.<br><br>This operation currently translates clear test PIN blocks for ISO formats 0, 1, and 3.";
+        this.description = "Paste a clear ISO 9564 PIN block into the input field as hex and translate it between supported clear block formats.<br><br><b>Input:</b> 8-byte clear PIN block as hex.<br><b>Arguments:</b> choose the source and target formats, provide source and target PAN values when required, and optionally randomize target filler digits for formats 1 and 3.<br><br>This operation currently translates clear test PIN blocks for ISO formats 0, 1, and 3.<br><br><b>Important:</b> PIN translation must not change the cardholder PAN. Translating a PIN block from one PAN to a different PAN is prohibited by PCI PIN security requirements. Always supply the same PAN for both source and target when the formats require it.";
         this.inlineHelp = "<strong>Input:</strong> source clear PIN block hex.<br><strong>Args:</strong> choose source and target formats, then provide the source and target PAN values where the formats require them.";
         this.testDataSamples = [
             {
@@ -55,7 +55,7 @@ class TranslatePINBlock extends Operation {
                 name: "Target PAN",
                 type: "string",
                 value: "",
-                comment: "Required when the target format is 0 or 3. Enter digits only; the implementation uses the rightmost 12 digits excluding the check digit."
+                comment: "Required when the target format is 0 or 3. Enter digits only; the implementation uses the rightmost 12 digits excluding the check digit. The target PAN must match the source PAN — translating a PIN block to a different PAN is prohibited by PCI PIN security requirements."
             },
             {
                 name: "Randomize target fill digits",

src/core/operations/TranslatePaymentPINData.mjs

@@ -18,7 +18,7 @@ class TranslatePaymentPINData extends Operation {
 
         this.name = "Translate Payment PIN Data";
         this.module = "Payment";
-        this.description = "Paste a clear PIN block into the input field as hex and translate it between supported clear ISO 9564 formats using an AWS-style wrapper.<br><br><b>Input:</b> clear PIN block hex.<br><b>Arguments:</b> choose source and target formats, provide PAN values when required, and optionally randomize target filler digits.";
+        this.description = "Paste a clear PIN block into the input field as hex and translate it between supported clear ISO 9564 formats.<br><br><b>Input:</b> clear PIN block hex.<br><b>Arguments:</b> choose source and target formats, provide PAN values when required, and optionally randomize target filler digits.<br><br><b>Important:</b> PIN translation must not change the cardholder PAN. Translating a PIN block from one PAN to a different PAN is prohibited by PCI PIN security requirements. Always supply the same PAN for both source and target when the formats require it.";
         this.inlineHelp = "<strong>Input:</strong> source clear PIN block hex.<br><strong>Args:</strong> define source and target format plus PAN context.";
         this.testDataSamples = [
             {
@@ -27,14 +27,14 @@ class TranslatePaymentPINData extends Operation {
                 args: ["ISO Format 0", "5432101234567890", "ISO Format 1", "", false]
             }
         ];
-        this.infoURL = "https://docs.aws.amazon.com/payment-cryptography/latest/DataAPIReference/API_TranslatePinData.html";
+        this.infoURL = "https://wikipedia.org/wiki/ISO_9564";
         this.inputType = "string";
         this.outputType = "string";
         this.args = [
             { name: "Source format", type: "option", value: ["ISO Format 0", "ISO Format 1", "ISO Format 3"], comment: "How to decode the input PIN block." },
             { name: "Source PAN", type: "string", value: "", comment: "Required for source formats 0 and 3." },
             { name: "Target format", type: "option", value: ["ISO Format 0", "ISO Format 1", "ISO Format 3"], defaultIndex: 1, comment: "Target clear PIN-block format." },
-            { name: "Target PAN", type: "string", value: "", comment: "Required for target formats 0 and 3." },
+            { name: "Target PAN", type: "string", value: "", comment: "Required for target formats 0 and 3. Must match the source PAN — translating a PIN block to a different PAN is prohibited by PCI PIN security requirements." },
             { name: "Randomize target fill digits", type: "boolean", value: false, comment: "Affects only target formats 1 and 3." },
         ];
     }

src/core/operations/VerifyCardValidationData.mjs

@@ -28,7 +28,7 @@ class VerifyCardValidationData extends Operation {
                 args: ["CVV2 / CVC2 (force 000)", "4123456789012345", "02", "25", "MMYY", "101", "221"]
             }
         ];
-        this.infoURL = "https://docs.aws.amazon.com/payment-cryptography/latest/userguide/verify-card-data.html";
+        this.infoURL = "https://en.wikipedia.org/wiki/Card_security_code";
         this.inputType = "string";
         this.outputType = "string";
         this.args = [

src/core/operations/VerifyEMVARQC.mjs

@@ -18,7 +18,7 @@ class VerifyEMVARQC extends Operation {
 
         this.name = "Verify EMV ARQC";
         this.module = "Payment";
-        this.description = "Paste the already-assembled EMV authorization-request input into the input field as hex and verify an AES-CMAC-based ARQC.<br><br><b>Input:</b> preassembled ARQC input data as hex.<br><b>Arguments:</b> provide the EMV session key, cryptogram length, and expected ARQC hex value.<br><br><b>Validation:</b> Partially verified. This checks the same supplied-key AES-CMAC EMV profile as generation and does not claim full scheme-level ARQC validation semantics.<br><br><b>Security:</b> Clear session keys are test-use only.";
+        this.description = "Paste the already-assembled EMV authorization-request input into the input field as hex and verify an AES-CMAC-based ARQC.<br><br><b>Input:</b> preassembled ARQC input data as hex.<br><b>Arguments:</b> provide the EMV session key, cryptogram length, and expected ARQC hex value.<br><br><b>Validation:</b> Partially verified. This checks the same supplied-key AES-CMAC EMV profile as generation and does not claim full scheme-level ARQC validation semantics.<br><br><b>Session key derivation:</b> In a full EMV flow the session key is derived from the issuer master key using the Application Transaction Counter (ATC) and PAN sequence number. Visa and Amex use EMV Common Session Key Derivation (Option A); Mastercard uses a different derivation (Option B). This operation expects you to supply the already-derived session key.<br><br><b>Security:</b> Clear session keys are test-use only.";
         this.inlineHelp = "<strong>Input:</strong> preassembled ARQC data as hex.<br><strong>Args:</strong> provide the AES session key and expected ARQC.<br><strong>Validation:</strong> same supplied-key EMV profile as generation.";
         this.testDataSamples = [
             {
@@ -27,7 +27,7 @@ class VerifyEMVARQC extends Operation {
                 args: ["00112233445566778899AABBCCDDEEFF", 8, "C1F732B52FB20CAA"]
             }
         ];
-        this.infoURL = "https://docs.aws.amazon.com/payment-cryptography/latest/DataAPIReference/API_VerifyAuthRequestCryptogram.html";
+        this.infoURL = "https://en.wikipedia.org/wiki/EMV";
         this.inputType = "string";
         this.outputType = "string";
         this.args = [

src/core/operations/VerifyEMVMAC.mjs

@@ -18,7 +18,7 @@ class VerifyEMVMAC extends Operation {
 
         this.name = "Verify EMV MAC";
         this.module = "Payment";
-        this.description = "Paste the issuer-script or EMV command payload into the input field as hex and verify an EMV MAC.<br><br><b>Input:</b> message data as hex.<br><b>Arguments:</b> provide the already-derived EMV session integrity key and the expected MAC as hex.<br><br><b>Validation:</b> Partially verified. This checks the same supplied-key EMV MAC profile as the generate operation and does not claim full issuer-host or scheme-specific EMV verification semantics.<br><br><b>Security:</b> Clear session keys in the recipe are test-use only.";
+        this.description = "Paste the issuer-script or EMV command payload into the input field as hex and verify an EMV MAC.<br><br><b>Input:</b> message data as hex.<br><b>Arguments:</b> provide the already-derived EMV session integrity key and the expected MAC as hex.<br><br><b>Validation:</b> Partially verified. This checks the same supplied-key EMV MAC profile as the generate operation and does not claim full issuer-host or scheme-specific EMV verification semantics.<br><br><b>Key context:</b> In a full issuer implementation, the session integrity key used here corresponds to the secure-messaging integrity key (distinct from the confidentiality key used to encrypt data and the PIN encryption key used for PIN blocks). This operation accepts any key you supply and does not enforce that separation.<br><br><b>Security:</b> Clear session keys in the recipe are test-use only.";
         this.inlineHelp = "<strong>Input:</strong> issuer-script message data as hex.<br><strong>Args:</strong> provide the derived EMV session key and expected MAC.<br><strong>Validation:</strong> same supplied-key EMV profile as generation.";
         this.testDataSamples = [
             {
@@ -27,7 +27,7 @@ class VerifyEMVMAC extends Operation {
                 args: ["0123456789ABCDEFFEDCBA9876543210", "22CB48394DFD1977", true]
             }
         ];
-        this.infoURL = "https://docs.aws.amazon.com/payment-cryptography/latest/userguide/use-cases-issuers.generalfunctions.emvmac.html";
+        this.infoURL = "https://en.wikipedia.org/wiki/EMV";
         this.inputType = "string";
         this.outputType = "string";
         this.args = [

src/core/operations/VerifyIBM3624PIN.mjs

@@ -27,7 +27,7 @@ class VerifyIBM3624PIN extends Operation {
                 args: ["0123456789ABCDEFFEDCBA9876543210", "0123456789012345", "5432101234567890", "F", "3207", true]
             }
         ];
-        this.infoURL = "https://docs.aws.amazon.com/payment-cryptography/latest/userguide/verify-pin-data.ibm3624-example.html";
+        this.infoURL = "https://en.wikipedia.org/wiki/IBM_3624";
         this.inputType = "string";
         this.outputType = "string";
         this.args = [

src/core/operations/VerifyPaymentMAC.mjs

@@ -28,7 +28,7 @@ class VerifyPaymentMAC extends Operation {
                 args: ["Hex", "AES-CMAC", "00112233445566778899AABBCCDDEEFF", "Hex", "", "Method 1", "339AF1AD1650E908", true]
             }
         ];
-        this.infoURL = "https://docs.aws.amazon.com/payment-cryptography/latest/DataAPIReference/API_VerifyMac.html";
+        this.infoURL = "https://en.wikipedia.org/wiki/Message_authentication_code";
         this.inputType = "string";
         this.outputType = "string";
         this.args = [
@@ -42,7 +42,7 @@ class VerifyPaymentMAC extends Operation {
                 name: "MAC method",
                 type: "option",
                 value: PAYMENT_MAC_METHODS,
-                comment: "Static-key HMAC and CMAC modes reuse the existing generic primitives. ISO9797 and AS2805 modes apply TDES-based payment MAC logic. DUKPT modes derive a TDES session key first."
+                comment: "Static-key HMAC and CMAC modes reuse the existing generic primitives. ISO9797 and AS2805 modes apply TDES-based payment MAC logic. DUKPT modes derive a TDES session key first. Note: ISO 9797-1 Algorithm 1 and Algorithm 3 are legacy MAC profiles — prefer AES-CMAC for new implementations."
             },
             {
                 name: "Key / BDK",

src/core/operations/VerifyPaymentPINData.mjs

@@ -18,7 +18,7 @@ class VerifyPaymentPINData extends Operation {
 
         this.name = "Verify Payment PIN Data";
         this.module = "Payment";
-        this.description = "Paste a clear PIN block into the input field as hex and verify it against an expected PIN using an AWS-style wrapper.<br><br><b>Input:</b> clear PIN block hex.<br><b>Arguments:</b> choose the format, provide the PAN when required, and supply the expected clear PIN.<br><br><b>Validation:</b> Partially verified. This wrapper currently covers clear ISO 9564 formats 0, 1, and 3 only.<br><br><b>Security:</b> Clear PIN handling is test-use only.";
+        this.description = "Paste a clear PIN block into the input field as hex and verify it against an expected PIN.<br><br><b>Input:</b> clear PIN block hex.<br><b>Arguments:</b> choose the format, provide the PAN when required, and supply the expected clear PIN.<br><br><b>Validation:</b> Partially verified. This wrapper currently covers clear ISO 9564 formats 0, 1, and 3 only.<br><br><b>Security:</b> Clear PIN handling is test-use only.";
         this.inlineHelp = "<strong>Input:</strong> clear PIN block hex.<br><strong>Args:</strong> define the PIN-block format, PAN context, and expected PIN.<br><strong>Validation:</strong> clear ISO formats 0, 1, and 3 only.";
         this.testDataSamples = [
             {
@@ -27,7 +27,7 @@ class VerifyPaymentPINData extends Operation {
                 args: ["ISO Format 0", "5432101234567890", "1234"]
             }
         ];
-        this.infoURL = "https://docs.aws.amazon.com/payment-cryptography/latest/DataAPIReference/API_VerifyPinData.html";
+        this.infoURL = "https://wikipedia.org/wiki/ISO_9564";
         this.inputType = "string";
         this.outputType = "string";
         this.args = [

src/core/operations/VerifyVISAPVV.mjs

@@ -27,7 +27,7 @@ class VerifyVISAPVV extends Operation {
                 args: ["0123456789ABCDEFFEDCBA9876543210", "5432101234567890", 1, "6077", true]
             }
         ];
-        this.infoURL = "https://docs.aws.amazon.com/payment-cryptography/latest/DataAPIReference/API_VisaPinVerificationValue.html";
+        this.infoURL = "https://en.wikipedia.org/wiki/ISO_9564";
         this.inputType = "string";
         this.outputType = "string";
         this.args = [