@agent-cards/sdk 0.23.25 → 0.23.26

package/CHANGELOG.md

@@ -4,6 +4,14 @@ An unreleased change waits as a file of its own in `changes/` (`changes/README.m
 
 ## Unreleased
 
+## 0.23.26
+
+- Pause Paymob's card payment for the cardholder's device. Paymob's own checkout in Egypt, the UAE, Saudi Arabia and Oman, Unified Checkout on `<country>.checkout.paymob.com` (where Paymob's payment links and its WooCommerce redirects land) and the Pixel card frame a merchant's page embeds, posts the card as JSON to `https://<accept|uae|ksa|oman>.paymob.com/api/acceptance/payments/pay` with the merchant's payment key. The sync now also asks for `capabilities=paymob_checkout_pay`, and the API serves Paymob's recognizer only for a company Agentcard turned Paymob on for. The SDK pauses only the card form's own payment at that exact URL: a card Paymob saved, a payment that keeps the card, pays in installments, splits the amount, converts its currency or names a Paymob account, and a payment key that enrolls a subscription or names no amount are refused at the pause, and another method's payment with no card (a wallet, Apple Pay, cash) continues to Paymob untouched. The cardholder's device sends the payment to Paymob itself with the real card, and the checkout gets Paymob's answer and runs 3-D Secure in the agent's browser. The payment key names the amount and currency, so `amount` and `currency` are optional; a pair you pass must match the key's. The API and the Vault already carry Paymob's side. Paymob stays off for every company Agentcard has not turned it on for.
+
+- Pay a PayU Latam WebCheckout card payment from the cardholder's device, for a company Agentcard turns PayU Latam on for (dark launch). The SDK declares `payu_latam_webcheckout_card` and pauses the card submit PayU's checkout page posts to `checkout.payulatam.com/ppp-web-gateway-payu/checkout/submit/<country>/credit_card/<key>`; the cardholder's device writes the real card into it and sends it to PayU, and the page gets PayU's answer. The submit names no price PayU charges, so pass `amount` and `currency`, above zero: the total PayU's page shows. Without them, `authorize()` throws `AmountRequiredError` and nothing is created.
+
+- Stop continuing Tap Payments' card token request for any merchant. Casefilegame, the Bahrain store that was the one Tap merchant Agentcard had reviewed, is no longer listed: since 2026-10-22 every page of that store shows a fake security check that tells a Mac visitor to open Terminal and paste a command. This build's copy of Agentcard's checkout rules lists no Tap merchant, so the SDK writes the device's ciphertext into no Tap token request, and an approved one fails in the agent's browser instead of continuing. The API already refuses the create for a Tap card form with `unsupported_checkout` (reason `tap_payments_merchant_unreviewed`) before anyone is asked, whatever SDK version sends it. Every other processor is unchanged.
+
 ## 0.23.25
 
 - Pause Barion's Smart Gateway (where Hungarian, Czech and Slovak shops send a buyer who pays by card) for the cardholder's device. The sync now also asks for `capabilities=barion_hosted_payment_page`, and the API serves Barion's recognizer only for a company Agentcard turned Barion on for. The SDK pauses the gateway link, `https://secure.barion.com/Pay?Id=<payment id>` (or `secure.test.barion.com` for a test payment), which carries no card, as a `hosted_form` authorization, and answers the paused navigation with the `submitted_on_device` page once the cardholder's device has paid it. The API takes a Barion entry only from the checkout page of a shop Agentcard reviewed, the page the SDK names as `checkout_origin`. The link names no amount, so send the total Barion's gateway shows, with its currency: `authorize()` throws `AmountRequiredError` without it, and the API refuses a create without one (`amount_required`). A merchant's server usually sends the buyer to the gateway with a redirect, and only `attachToCdp` pauses a redirect, so attach to a Barion checkout with `attachToCdp`. Every post a page the SDK watches makes to the gateway, such as its email check and its card posts, leads to a card: the SDK fails each one and reads `unsupported` with reason `processor_card_page`. Matching API and Vault releases are required, and no Barion shop is reviewed yet. Barion stays off for every company Agentcard has not turned it on for.

package/README.md

@@ -301,7 +301,7 @@ so new processors work without you shipping a release. `attachToCdp` derives the
 `Fetch.enable` url patterns from that same list rather than a constant, which is
 why the sync call belongs before the attach. `agentcard.checkout.cardUrlPatterns()` returns
 those patterns if you arm a CDP connection yourself. Call
-`GET /v2/checkout/recognizers?modes=token,cse,hosted_form,device_encrypt&capabilities=fiserv_card_capture,gmo_shared_pk,capture_context,juspay_txns.v1,datatrans_secure_fields_tokenize,authorize_net_dpm_form,pelecard_transaction,aci_split_card.v1,creditguard_pps_process,primer_payment_instruments,payrails_device_encrypt,converge_hpp_process,worldpay_eprotect_jsonp,wspay_confirm,shiji_sts_pinned_key,amadeus_checkout_actions.v1,worldline_mycheckout_form,verifone_card_capture,ekashu_hosted_payment_page,cybersource_sa_token_create,gravy_session_fields_put,moneris_hosted_tokenization,paddle_vgs_cards,paddle_tokenex_pay,redsys_hosted_payment_page,lyra_krypton_payment,payfast_card_pay,wix_payments_tokenize,paymongo_checkout_pay,paygent_token,pay_nl_card_token,hipay_vault_token,twoc2p_secure_pay,quickpay_hosted_payment_page,revolut_card_field,paypal_card_fields,gopay_card_form,payrexx_card_frame,comgate_hosted_payment_page,przelewy24_hosted_payment_page,makecommerce_card_frame,poynt_collect_nonce,tokenex_iframe_tokenize,transbank_webpay_hosted_payment_page,sumup_checkout_process,clover_card_token,eximbay_hosted_payment_page,toast_pinned_key,xendit_card_token,omise_card_token,paytrail_hosted_payment_page,fastspring_card_payment,openpay_tokenizer,barion_hosted_payment_page`
+`GET /v2/checkout/recognizers?modes=token,cse,hosted_form,device_encrypt&capabilities=fiserv_card_capture,gmo_shared_pk,capture_context,juspay_txns.v1,datatrans_secure_fields_tokenize,authorize_net_dpm_form,pelecard_transaction,aci_split_card.v1,creditguard_pps_process,primer_payment_instruments,payrails_device_encrypt,converge_hpp_process,worldpay_eprotect_jsonp,wspay_confirm,shiji_sts_pinned_key,amadeus_checkout_actions.v1,worldline_mycheckout_form,verifone_card_capture,ekashu_hosted_payment_page,cybersource_sa_token_create,gravy_session_fields_put,moneris_hosted_tokenization,paddle_vgs_cards,paddle_tokenex_pay,redsys_hosted_payment_page,lyra_krypton_payment,payfast_card_pay,wix_payments_tokenize,paymongo_checkout_pay,paygent_token,pay_nl_card_token,hipay_vault_token,twoc2p_secure_pay,quickpay_hosted_payment_page,revolut_card_field,paypal_card_fields,gopay_card_form,payrexx_card_frame,comgate_hosted_payment_page,przelewy24_hosted_payment_page,makecommerce_card_frame,poynt_collect_nonce,tokenex_iframe_tokenize,transbank_webpay_hosted_payment_page,sumup_checkout_process,clover_card_token,eximbay_hosted_payment_page,toast_pinned_key,xendit_card_token,omise_card_token,paytrail_hosted_payment_page,fastspring_card_payment,openpay_tokenizer,barion_hosted_payment_page,paymob_checkout_pay,payu_latam_webcheckout_card,nexi_checkout_pay`
 for the list this build syncs. The API serves Fiserv's card capture only to a
 build that lists `fiserv_card_capture`, and only for a company Agentcard turned
 Fiserv on for. An older SDK never pauses a Fiserv request it could not finish,
@@ -436,6 +436,34 @@ writes the real card into it and sends it through Agentcard's checkout relay to
 a store Agentcard reviewed, and the checkout gets FastSpring's answer. The
 payment names no price, so pass `amount` and `currency`, above zero: the total
 the checkout shows, tax included, which the API holds to FastSpring's own figure.
+Paymob's checkout (`paymob_checkout_pay`) is served on the same terms: this
+build pauses the card payment that Paymob's Unified Checkout, or the Pixel card
+frame a merchant's page embeds, posts to
+`<accept|uae|ksa|oman>.paymob.com/api/acceptance/payments/pay`, the
+cardholder's device sends it to Paymob itself with the real card, and the
+checkout gets Paymob's answer and runs 3-D Secure. A wallet's or another
+method's payment on the same URL carries no card and continues to Paymob. The
+payment key names the amount, so `amount` and `currency` are optional; a pair
+you pass must match the key's.
+PayU Latam's WebCheckout (`payu_latam_webcheckout_card`) is served on the same
+terms: this build pauses the card submit PayU's checkout page posts to
+`checkout.payulatam.com/ppp-web-gateway-payu/checkout/submit/<country>/credit_card/<key>`,
+the cardholder's device writes the real card into it and sends it to PayU, and
+the page gets PayU's answer. The API pays only a PayU account Agentcard
+reviewed. The submit's copy of the order is the page's, so pass `amount` and
+`currency`, above zero: the total PayU's page shows, which the API holds to
+the order PayU reads back.
+Nexi Checkout's card frame (`nexi_checkout_pay`, formerly Nets Easy) is served on
+the same terms: this build pauses the card payment the frame posts to
+`https://checkout.dibspayment.eu/api/v1/pay`, the cardholder's device reads
+Nexi's own record of the payment and sends the card through Agentcard's
+checkout relay to a merchant Agentcard reviewed for the checkout page, and the
+frame gets Nexi's answer. The payment names its amount in minor units but not
+its currency, so pass `amount` and `currency`, above zero: the total the
+checkout shows, which the API holds to the payment's own amount and the device
+holds to Nexi's record. The SDK sends the checkout page's origin as
+`checkout_origin`, which for Nexi's hosted page is `https://checkout.dibspayment.eu`,
+and the API pays only a merchant reviewed for that page.
 CyberSource Secure Acceptance's token
 create (`cybersource_sa_token_create`) is served on the same terms too; every
 other company keeps the stop every build applies to a card posted to Secure

package/dist/agent-amount.generated.js

@@ -1,3 +1,3 @@
 // Written by scripts/generate-agent-amount.mjs from agent-amount-processors.json. Do not edit; git ignores it.
 /** agent-amount-processors.json, sorted; client.ts reads its amount tables from it. */
-export const AGENT_AMOUNT = { "processors": ["amazon_payment_services", "barion", "clover", "comgate", "cybersource_secure_acceptance", "fastspring", "gmo_pg", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "omise", "openpay_bbva", "paddle_vgs", "pay_nl", "payfast", "paygent", "paymongo", "paypal", "payrexx", "paytrail", "pelecard", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p", "wix_payments", "wspay"], "aboveZero": ["amazon_payment_services", "barion", "clover", "comgate", "fastspring", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "omise", "openpay_bbva", "pay_nl", "payfast", "paymongo", "paypal", "payrexx", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p"], "pageAmount": ["pelecard", "sb_payment_service"], "names": { "amazon_payment_services": "Amazon Payment Services", "barion": "Barion", "clover": "Clover", "comgate": "ComGate", "cybersource_secure_acceptance": "CyberSource Secure Acceptance", "fastspring": "FastSpring", "gmo_pg": "GMO", "gopay": "GoPay", "hipay": "HiPay", "makecommerce": "MakeCommerce", "midtrans": "Midtrans", "moneris": "Moneris", "omise": "Omise", "openpay_bbva": "Openpay", "paddle_vgs": "Paddle", "pay_nl": "Pay.", "payfast": "Payfast", "paygent": "Paygent", "paymongo": "PayMongo", "paypal": "PayPal", "payrexx": "Payrexx", "paytrail": "Paytrail", "pelecard": "Pelecard", "poynt": "GoDaddy Payments", "przelewy24": "Przelewy24", "revolut": "Revolut", "sb_payment_service": "SB Payment Service", "sumup": "SumUp", "tap_payments": "Tap", "toast": "Toast", "tokenex_iframe": "TokenEx", "transbank_webpay": "Webpay", "twoc2p": "2C2P", "wix_payments": "Wix", "wspay": "WSPay" } };
+export const AGENT_AMOUNT = { "processors": ["amazon_payment_services", "barion", "clover", "comgate", "cybersource_secure_acceptance", "fastspring", "gmo_pg", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "nexi_checkout", "omise", "openpay_bbva", "paddle_vgs", "pay_nl", "payfast", "paygent", "paymongo", "paypal", "payrexx", "paytrail", "payu_latam", "pelecard", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p", "wix_payments", "wspay"], "aboveZero": ["amazon_payment_services", "barion", "clover", "comgate", "fastspring", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "nexi_checkout", "omise", "openpay_bbva", "pay_nl", "payfast", "paymongo", "paypal", "payrexx", "payu_latam", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p"], "pageAmount": ["pelecard", "sb_payment_service"], "names": { "amazon_payment_services": "Amazon Payment Services", "barion": "Barion", "clover": "Clover", "comgate": "ComGate", "cybersource_secure_acceptance": "CyberSource Secure Acceptance", "fastspring": "FastSpring", "gmo_pg": "GMO", "gopay": "GoPay", "hipay": "HiPay", "makecommerce": "MakeCommerce", "midtrans": "Midtrans", "moneris": "Moneris", "nexi_checkout": "Nexi Checkout", "omise": "Omise", "openpay_bbva": "Openpay", "paddle_vgs": "Paddle", "pay_nl": "Pay.", "payfast": "Payfast", "paygent": "Paygent", "paymongo": "PayMongo", "paypal": "PayPal", "payrexx": "Payrexx", "paytrail": "Paytrail", "payu_latam": "PayU Latam", "pelecard": "Pelecard", "poynt": "GoDaddy Payments", "przelewy24": "Przelewy24", "revolut": "Revolut", "sb_payment_service": "SB Payment Service", "sumup": "SumUp", "tap_payments": "Tap", "toast": "Toast", "tokenex_iframe": "TokenEx", "transbank_webpay": "Webpay", "twoc2p": "2C2P", "wix_payments": "Wix", "wspay": "WSPay" } };

package/dist/capabilities.generated.js

@@ -1,3 +1,3 @@
 // Written by scripts/generate-capabilities.mjs from capabilities.json. Do not edit; git ignores it.
 /** capabilities.json's list, sorted; client.ts exports it as SUPPORTED_CAPABILITIES. */
-export const DECLARED_CAPABILITIES = ["aci_split_card.v1", "amadeus_checkout_actions.v1", "aps_custom_merchant_page", "authorize_net_dpm_form", "barion_hosted_payment_page", "capture_context", "clover_card_token", "comgate_hosted_payment_page", "converge_hpp_process", "creditguard_pps_process", "cybersource_sa_token_create", "datatrans_secure_fields_tokenize", "ekashu_hosted_payment_page", "eximbay_hosted_payment_page", "fastspring_card_payment", "fiserv_card_capture", "gmo_shared_pk", "gopay_card_form", "gravy_session_fields_put", "hipay_vault_token", "juspay_txns.v1", "lyra_krypton_payment", "makecommerce_card_frame", "midtrans_card_token", "moneris_hosted_tokenization", "omise_card_token", "openpay_tokenizer", "paddle_tokenex_pay", "paddle_vgs_cards", "pay_nl_card_token", "payfast_card_pay", "paygent_token", "paymongo_checkout_pay", "paypal_card_fields", "payrails_device_encrypt", "payrexx_card_frame", "paytrail_hosted_payment_page", "pelecard_transaction", "poynt_collect_nonce", "primer_payment_instruments", "przelewy24_hosted_payment_page", "quickpay_hosted_payment_page", "redsys_hosted_payment_page", "revolut_card_field", "sbps_token_jsonp", "shiji_sts_pinned_key", "sumup_checkout_process", "tap_card_sdk_token", "toast_pinned_key", "tokenex_iframe_tokenize", "transbank_webpay_hosted_payment_page", "twoc2p_secure_pay", "verifone_card_capture", "wix_payments_tokenize", "worldline_mycheckout_form", "worldpay_eprotect_jsonp", "wspay_confirm", "xendit_card_token"];
+export const DECLARED_CAPABILITIES = ["aci_split_card.v1", "amadeus_checkout_actions.v1", "aps_custom_merchant_page", "authorize_net_dpm_form", "barion_hosted_payment_page", "capture_context", "clover_card_token", "comgate_hosted_payment_page", "converge_hpp_process", "creditguard_pps_process", "cybersource_sa_token_create", "datatrans_secure_fields_tokenize", "ekashu_hosted_payment_page", "eximbay_hosted_payment_page", "fastspring_card_payment", "fiserv_card_capture", "gmo_shared_pk", "gopay_card_form", "gravy_session_fields_put", "hipay_vault_token", "juspay_txns.v1", "lyra_krypton_payment", "makecommerce_card_frame", "midtrans_card_token", "moneris_hosted_tokenization", "nexi_checkout_pay", "omise_card_token", "openpay_tokenizer", "paddle_tokenex_pay", "paddle_vgs_cards", "pay_nl_card_token", "payfast_card_pay", "paygent_token", "paymob_checkout_pay", "paymongo_checkout_pay", "paypal_card_fields", "payrails_device_encrypt", "payrexx_card_frame", "paytrail_hosted_payment_page", "payu_latam_webcheckout_card", "pelecard_transaction", "poynt_collect_nonce", "primer_payment_instruments", "przelewy24_hosted_payment_page", "quickpay_hosted_payment_page", "redsys_hosted_payment_page", "revolut_card_field", "sbps_token_jsonp", "shiji_sts_pinned_key", "sumup_checkout_process", "tap_card_sdk_token", "toast_pinned_key", "tokenex_iframe_tokenize", "transbank_webpay_hosted_payment_page", "twoc2p_secure_pay", "verifone_card_capture", "wix_payments_tokenize", "worldline_mycheckout_form", "worldpay_eprotect_jsonp", "wspay_confirm", "xendit_card_token"];