@agent-cards/sdk 0.23.25 → 0.23.27

package/CHANGELOG.md

@@ -4,6 +4,22 @@ An unreleased change waits as a file of its own in `changes/` (`changes/README.m
 
 ## Unreleased
 
+## 0.23.27
+
+- Pause Pin Payments' card request for the cardholder's device, for a company Agentcard turned Pin Payments on for. Pin's Hosted Fields (its control frame on `cdn.pinpayments.com`) and Pin.js on a merchant's own page send the card as JSON to `https://api.pinpayments.com/1/cards` under the merchant's publishable key, and Pin answers with a card token the merchant's server charges afterwards. The sync now also asks for `capabilities=pin_payments_card_token`, and the API serves Pin's recognizer only for a company Agentcard turned Pin on for. The SDK pauses only the card fields' own request at that exact URL: a secret key, an amount or any other body there fails in your browser before anything is created, and Pin's JSONP form and a card's own record are never paused. The cardholder's device sends the request to Pin itself with the real card, and the page gets Pin's card token. Pin's request names no price, so pass `amount` and `currency`, above zero: without them `authorize()` throws `AmountRequiredError` before anything is created. The API pays only a Pin account Agentcard reviewed for the checkout page the request comes from. Matching API and Vault releases are required. Pin Payments stays off for every company Agentcard has not turned it on for.
+
+- Stop the card request Nike's checkout sends from its own card frame. Nike's guest checkout on `www.nike.com` takes the card in a frame on `paymentcc.nike.com`, and that frame posts it, once the three fields are valid and before any button is pressed, to `https://paymentcc.nike.com/creditcardsubmit/<creditCardInfoId>/store`. No processor is on the page, so before this change nothing armed that request. The adapters now pause it and refuse it as `unsupported_checkout` while Nike's profile, `nike_paymentcc_store`, is in `observe`, so the agent's dummy card never reaches Nike. The frame's security code update, a `PUT` to `/creditcardsubmit/<creditCardInfoId>/update`, is aborted in every status as `card_endpoint_refused` with reason `card_resend`. The profile reads the body the frame builds: `accountNumber`, `cardType` one of `VISA`, `MASTERCARD`, `AMERICANEXPRESS` or `DISCOVER`, a two-digit `expirationMonth`, a four-digit `expirationYear`, `cvNumber`, and a `creditCardInfoId` equal to the one in the URL.
+
+## 0.23.26
+
+- Pause Paymob's card payment for the cardholder's device. Paymob's own checkout in Egypt, the UAE, Saudi Arabia and Oman, Unified Checkout on `<country>.checkout.paymob.com` (where Paymob's payment links and its WooCommerce redirects land) and the Pixel card frame a merchant's page embeds, posts the card as JSON to `https://<accept|uae|ksa|oman>.paymob.com/api/acceptance/payments/pay` with the merchant's payment key. The sync now also asks for `capabilities=paymob_checkout_pay`, and the API serves Paymob's recognizer only for a company Agentcard turned Paymob on for. The SDK pauses only the card form's own payment at that exact URL: a card Paymob saved, a payment that keeps the card, pays in installments, splits the amount, converts its currency or names a Paymob account, and a payment key that enrolls a subscription or names no amount are refused at the pause, and another method's payment with no card (a wallet, Apple Pay, cash) continues to Paymob untouched. The cardholder's device sends the payment to Paymob itself with the real card, and the checkout gets Paymob's answer and runs 3-D Secure in the agent's browser. The payment key names the amount and currency, so `amount` and `currency` are optional; a pair you pass must match the key's. The API and the Vault already carry Paymob's side. Paymob stays off for every company Agentcard has not turned it on for.
+
+- Pay a PayU Latam WebCheckout card payment from the cardholder's device, for a company Agentcard turns PayU Latam on for (dark launch). The SDK declares `payu_latam_webcheckout_card` and pauses the card submit PayU's checkout page posts to `checkout.payulatam.com/ppp-web-gateway-payu/checkout/submit/<country>/credit_card/<key>`; the cardholder's device writes the real card into it and sends it to PayU, and the page gets PayU's answer. The submit names no price PayU charges, so pass `amount` and `currency`, above zero: the total PayU's page shows. Without them, `authorize()` throws `AmountRequiredError` and nothing is created.
+
+- Stop continuing Tap Payments' card token request for any merchant. Casefilegame, the Bahrain store that was the one Tap merchant Agentcard had reviewed, is no longer listed: since 2026-10-22 every page of that store shows a fake security check that tells a Mac visitor to open Terminal and paste a command. This build's copy of Agentcard's checkout rules lists no Tap merchant, so the SDK writes the device's ciphertext into no Tap token request, and an approved one fails in the agent's browser instead of continuing. The API already refuses the create for a Tap card form with `unsupported_checkout` (reason `tap_payments_merchant_unreviewed`) before anyone is asked, whatever SDK version sends it. Every other processor is unchanged.
+
+- Pay a Nexi Checkout card payment through the checkout relay, for a company Agentcard turns Nexi Checkout on for (dark launch). Nexi Checkout (formerly Nets Easy, used by Danish, Norwegian, Swedish and Finnish merchants) takes the card in its own card frame, which posts it to `https://checkout.dibspayment.eu/api/v1/pay` under the merchant's checkout key. This build declares `nexi_checkout_pay` on every sync, and the API serves the Nexi entry only to a company Agentcard turned Nexi Checkout on for, so every other company's Nexi payments go through untouched, as for an unsupported processor. For an enabled company the SDK pauses only the card form's own payment; a post with "save my card", "remember me" or a card fee is refused before anything is sent, and the frame's card lookup while the number is typed continues untouched. The payment names its amount in minor units but not its currency, so `authorize()` refuses one without `amount` above zero and `currency` (`AmountRequiredError`): send the total the checkout shows. The SDK sends the checkout page's origin as `checkout_origin` (`https://checkout.dibspayment.eu` for Nexi's hosted page), and the API pays only a merchant reviewed for that page. The cardholder's device reads Nexi's own record of the payment and sends the card through the checkout relay, and the frame gets Nexi's answer: the payment done, or Nexi's 3-D Secure step, which the frame runs in the agent's browser, where a challenge needs a person at that browser. A Nexi payment also needs the matching API, Vault and checkout relay releases, and a merchant Agentcard reviewed.
+
 ## 0.23.25
 
 - Pause Barion's Smart Gateway (where Hungarian, Czech and Slovak shops send a buyer who pays by card) for the cardholder's device. The sync now also asks for `capabilities=barion_hosted_payment_page`, and the API serves Barion's recognizer only for a company Agentcard turned Barion on for. The SDK pauses the gateway link, `https://secure.barion.com/Pay?Id=<payment id>` (or `secure.test.barion.com` for a test payment), which carries no card, as a `hosted_form` authorization, and answers the paused navigation with the `submitted_on_device` page once the cardholder's device has paid it. The API takes a Barion entry only from the checkout page of a shop Agentcard reviewed, the page the SDK names as `checkout_origin`. The link names no amount, so send the total Barion's gateway shows, with its currency: `authorize()` throws `AmountRequiredError` without it, and the API refuses a create without one (`amount_required`). A merchant's server usually sends the buyer to the gateway with a redirect, and only `attachToCdp` pauses a redirect, so attach to a Barion checkout with `attachToCdp`. Every post a page the SDK watches makes to the gateway, such as its email check and its card posts, leads to a card: the SDK fails each one and reads `unsupported` with reason `processor_card_page`. Matching API and Vault releases are required, and no Barion shop is reviewed yet. Barion stays off for every company Agentcard has not turned it on for.

package/README.md

@@ -301,7 +301,7 @@ so new processors work without you shipping a release. `attachToCdp` derives the
 `Fetch.enable` url patterns from that same list rather than a constant, which is
 why the sync call belongs before the attach. `agentcard.checkout.cardUrlPatterns()` returns
 those patterns if you arm a CDP connection yourself. Call
-`GET /v2/checkout/recognizers?modes=token,cse,hosted_form,device_encrypt&capabilities=fiserv_card_capture,gmo_shared_pk,capture_context,juspay_txns.v1,datatrans_secure_fields_tokenize,authorize_net_dpm_form,pelecard_transaction,aci_split_card.v1,creditguard_pps_process,primer_payment_instruments,payrails_device_encrypt,converge_hpp_process,worldpay_eprotect_jsonp,wspay_confirm,shiji_sts_pinned_key,amadeus_checkout_actions.v1,worldline_mycheckout_form,verifone_card_capture,ekashu_hosted_payment_page,cybersource_sa_token_create,gravy_session_fields_put,moneris_hosted_tokenization,paddle_vgs_cards,paddle_tokenex_pay,redsys_hosted_payment_page,lyra_krypton_payment,payfast_card_pay,wix_payments_tokenize,paymongo_checkout_pay,paygent_token,pay_nl_card_token,hipay_vault_token,twoc2p_secure_pay,quickpay_hosted_payment_page,revolut_card_field,paypal_card_fields,gopay_card_form,payrexx_card_frame,comgate_hosted_payment_page,przelewy24_hosted_payment_page,makecommerce_card_frame,poynt_collect_nonce,tokenex_iframe_tokenize,transbank_webpay_hosted_payment_page,sumup_checkout_process,clover_card_token,eximbay_hosted_payment_page,toast_pinned_key,xendit_card_token,omise_card_token,paytrail_hosted_payment_page,fastspring_card_payment,openpay_tokenizer,barion_hosted_payment_page`
+`GET /v2/checkout/recognizers?modes=token,cse,hosted_form,device_encrypt&capabilities=fiserv_card_capture,gmo_shared_pk,capture_context,juspay_txns.v1,datatrans_secure_fields_tokenize,authorize_net_dpm_form,pelecard_transaction,aci_split_card.v1,creditguard_pps_process,primer_payment_instruments,payrails_device_encrypt,converge_hpp_process,worldpay_eprotect_jsonp,wspay_confirm,shiji_sts_pinned_key,amadeus_checkout_actions.v1,worldline_mycheckout_form,verifone_card_capture,ekashu_hosted_payment_page,cybersource_sa_token_create,gravy_session_fields_put,moneris_hosted_tokenization,paddle_vgs_cards,paddle_tokenex_pay,redsys_hosted_payment_page,lyra_krypton_payment,payfast_card_pay,wix_payments_tokenize,paymongo_checkout_pay,paygent_token,pay_nl_card_token,hipay_vault_token,twoc2p_secure_pay,quickpay_hosted_payment_page,revolut_card_field,paypal_card_fields,gopay_card_form,payrexx_card_frame,comgate_hosted_payment_page,przelewy24_hosted_payment_page,makecommerce_card_frame,poynt_collect_nonce,tokenex_iframe_tokenize,transbank_webpay_hosted_payment_page,sumup_checkout_process,clover_card_token,eximbay_hosted_payment_page,toast_pinned_key,xendit_card_token,omise_card_token,paytrail_hosted_payment_page,fastspring_card_payment,openpay_tokenizer,barion_hosted_payment_page,paymob_checkout_pay,payu_latam_webcheckout_card,nexi_checkout_pay,pin_payments_card_token`
 for the list this build syncs. The API serves Fiserv's card capture only to a
 build that lists `fiserv_card_capture`, and only for a company Agentcard turned
 Fiserv on for. An older SDK never pauses a Fiserv request it could not finish,
@@ -429,6 +429,14 @@ page, the cardholder's device sends it to Omise itself with the real card, and
 the page gets Omise's token. The API pays only a merchant Agentcard reviewed
 for the page the request comes from. Omise's request names no price, so pass
 `amount` and `currency`, above zero: that is the amount the cardholder approves.
+Pin Payments' card request (`pin_payments_card_token`) is served on the same
+terms: this build pauses the card request Pin's Hosted Fields or Pin.js sends to
+`https://api.pinpayments.com/1/cards`, the cardholder's device sends it to Pin
+itself with the real card, and the page gets Pin's card token, which the
+merchant's server charges afterwards. The API pays only a Pin account Agentcard
+reviewed for the page the request comes from. Pin's request names no price, so
+pass `amount` and `currency`, above zero: that is the amount the cardholder
+approves.
 FastSpring's checkout (`fastspring_card_payment`) is served on the same terms:
 this build pauses the card payment the checkout posts to
 `<store>.onfastspring.com/.../session/<id>/payment`, the cardholder's device
@@ -436,6 +444,34 @@ writes the real card into it and sends it through Agentcard's checkout relay to
 a store Agentcard reviewed, and the checkout gets FastSpring's answer. The
 payment names no price, so pass `amount` and `currency`, above zero: the total
 the checkout shows, tax included, which the API holds to FastSpring's own figure.
+Paymob's checkout (`paymob_checkout_pay`) is served on the same terms: this
+build pauses the card payment that Paymob's Unified Checkout, or the Pixel card
+frame a merchant's page embeds, posts to
+`<accept|uae|ksa|oman>.paymob.com/api/acceptance/payments/pay`, the
+cardholder's device sends it to Paymob itself with the real card, and the
+checkout gets Paymob's answer and runs 3-D Secure. A wallet's or another
+method's payment on the same URL carries no card and continues to Paymob. The
+payment key names the amount, so `amount` and `currency` are optional; a pair
+you pass must match the key's.
+PayU Latam's WebCheckout (`payu_latam_webcheckout_card`) is served on the same
+terms: this build pauses the card submit PayU's checkout page posts to
+`checkout.payulatam.com/ppp-web-gateway-payu/checkout/submit/<country>/credit_card/<key>`,
+the cardholder's device writes the real card into it and sends it to PayU, and
+the page gets PayU's answer. The API pays only a PayU account Agentcard
+reviewed. The submit's copy of the order is the page's, so pass `amount` and
+`currency`, above zero: the total PayU's page shows, which the API holds to
+the order PayU reads back.
+Nexi Checkout's card frame (`nexi_checkout_pay`, formerly Nets Easy) is served on
+the same terms: this build pauses the card payment the frame posts to
+`https://checkout.dibspayment.eu/api/v1/pay`, the cardholder's device reads
+Nexi's own record of the payment and sends the card through Agentcard's
+checkout relay to a merchant Agentcard reviewed for the checkout page, and the
+frame gets Nexi's answer. The payment names its amount in minor units but not
+its currency, so pass `amount` and `currency`, above zero: the total the
+checkout shows, which the API holds to the payment's own amount and the device
+holds to Nexi's record. The SDK sends the checkout page's origin as
+`checkout_origin`, which for Nexi's hosted page is `https://checkout.dibspayment.eu`,
+and the API pays only a merchant reviewed for that page.
 CyberSource Secure Acceptance's token
 create (`cybersource_sa_token_create`) is served on the same terms too; every
 other company keeps the stop every build applies to a card posted to Secure

package/dist/agent-amount.generated.js

@@ -1,3 +1,3 @@
 // Written by scripts/generate-agent-amount.mjs from agent-amount-processors.json. Do not edit; git ignores it.
 /** agent-amount-processors.json, sorted; client.ts reads its amount tables from it. */
-export const AGENT_AMOUNT = { "processors": ["amazon_payment_services", "barion", "clover", "comgate", "cybersource_secure_acceptance", "fastspring", "gmo_pg", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "omise", "openpay_bbva", "paddle_vgs", "pay_nl", "payfast", "paygent", "paymongo", "paypal", "payrexx", "paytrail", "pelecard", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p", "wix_payments", "wspay"], "aboveZero": ["amazon_payment_services", "barion", "clover", "comgate", "fastspring", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "omise", "openpay_bbva", "pay_nl", "payfast", "paymongo", "paypal", "payrexx", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p"], "pageAmount": ["pelecard", "sb_payment_service"], "names": { "amazon_payment_services": "Amazon Payment Services", "barion": "Barion", "clover": "Clover", "comgate": "ComGate", "cybersource_secure_acceptance": "CyberSource Secure Acceptance", "fastspring": "FastSpring", "gmo_pg": "GMO", "gopay": "GoPay", "hipay": "HiPay", "makecommerce": "MakeCommerce", "midtrans": "Midtrans", "moneris": "Moneris", "omise": "Omise", "openpay_bbva": "Openpay", "paddle_vgs": "Paddle", "pay_nl": "Pay.", "payfast": "Payfast", "paygent": "Paygent", "paymongo": "PayMongo", "paypal": "PayPal", "payrexx": "Payrexx", "paytrail": "Paytrail", "pelecard": "Pelecard", "poynt": "GoDaddy Payments", "przelewy24": "Przelewy24", "revolut": "Revolut", "sb_payment_service": "SB Payment Service", "sumup": "SumUp", "tap_payments": "Tap", "toast": "Toast", "tokenex_iframe": "TokenEx", "transbank_webpay": "Webpay", "twoc2p": "2C2P", "wix_payments": "Wix", "wspay": "WSPay" } };
+export const AGENT_AMOUNT = { "processors": ["amazon_payment_services", "barion", "clover", "comgate", "cybersource_secure_acceptance", "fastspring", "gmo_pg", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "nexi_checkout", "omise", "openpay_bbva", "paddle_vgs", "pay_nl", "payfast", "paygent", "paymongo", "paypal", "payrexx", "paytrail", "payu_latam", "pelecard", "pin_payments", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p", "wix_payments", "wspay"], "aboveZero": ["amazon_payment_services", "barion", "clover", "comgate", "fastspring", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "nexi_checkout", "omise", "openpay_bbva", "pay_nl", "payfast", "paymongo", "paypal", "payrexx", "payu_latam", "pin_payments", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p"], "pageAmount": ["pelecard", "sb_payment_service"], "names": { "amazon_payment_services": "Amazon Payment Services", "barion": "Barion", "clover": "Clover", "comgate": "ComGate", "cybersource_secure_acceptance": "CyberSource Secure Acceptance", "fastspring": "FastSpring", "gmo_pg": "GMO", "gopay": "GoPay", "hipay": "HiPay", "makecommerce": "MakeCommerce", "midtrans": "Midtrans", "moneris": "Moneris", "nexi_checkout": "Nexi Checkout", "omise": "Omise", "openpay_bbva": "Openpay", "paddle_vgs": "Paddle", "pay_nl": "Pay.", "payfast": "Payfast", "paygent": "Paygent", "paymongo": "PayMongo", "paypal": "PayPal", "payrexx": "Payrexx", "paytrail": "Paytrail", "payu_latam": "PayU Latam", "pelecard": "Pelecard", "pin_payments": "Pin Payments", "poynt": "GoDaddy Payments", "przelewy24": "Przelewy24", "revolut": "Revolut", "sb_payment_service": "SB Payment Service", "sumup": "SumUp", "tap_payments": "Tap", "toast": "Toast", "tokenex_iframe": "TokenEx", "transbank_webpay": "Webpay", "twoc2p": "2C2P", "wix_payments": "Wix", "wspay": "WSPay" } };

package/dist/capabilities.generated.js

@@ -1,3 +1,3 @@
 // Written by scripts/generate-capabilities.mjs from capabilities.json. Do not edit; git ignores it.
 /** capabilities.json's list, sorted; client.ts exports it as SUPPORTED_CAPABILITIES. */
-export const DECLARED_CAPABILITIES = ["aci_split_card.v1", "amadeus_checkout_actions.v1", "aps_custom_merchant_page", "authorize_net_dpm_form", "barion_hosted_payment_page", "capture_context", "clover_card_token", "comgate_hosted_payment_page", "converge_hpp_process", "creditguard_pps_process", "cybersource_sa_token_create", "datatrans_secure_fields_tokenize", "ekashu_hosted_payment_page", "eximbay_hosted_payment_page", "fastspring_card_payment", "fiserv_card_capture", "gmo_shared_pk", "gopay_card_form", "gravy_session_fields_put", "hipay_vault_token", "juspay_txns.v1", "lyra_krypton_payment", "makecommerce_card_frame", "midtrans_card_token", "moneris_hosted_tokenization", "omise_card_token", "openpay_tokenizer", "paddle_tokenex_pay", "paddle_vgs_cards", "pay_nl_card_token", "payfast_card_pay", "paygent_token", "paymongo_checkout_pay", "paypal_card_fields", "payrails_device_encrypt", "payrexx_card_frame", "paytrail_hosted_payment_page", "pelecard_transaction", "poynt_collect_nonce", "primer_payment_instruments", "przelewy24_hosted_payment_page", "quickpay_hosted_payment_page", "redsys_hosted_payment_page", "revolut_card_field", "sbps_token_jsonp", "shiji_sts_pinned_key", "sumup_checkout_process", "tap_card_sdk_token", "toast_pinned_key", "tokenex_iframe_tokenize", "transbank_webpay_hosted_payment_page", "twoc2p_secure_pay", "verifone_card_capture", "wix_payments_tokenize", "worldline_mycheckout_form", "worldpay_eprotect_jsonp", "wspay_confirm", "xendit_card_token"];
+export const DECLARED_CAPABILITIES = ["aci_split_card.v1", "amadeus_checkout_actions.v1", "aps_custom_merchant_page", "authorize_net_dpm_form", "barion_hosted_payment_page", "capture_context", "clover_card_token", "comgate_hosted_payment_page", "converge_hpp_process", "creditguard_pps_process", "cybersource_sa_token_create", "datatrans_secure_fields_tokenize", "ekashu_hosted_payment_page", "eximbay_hosted_payment_page", "fastspring_card_payment", "fiserv_card_capture", "gmo_shared_pk", "gopay_card_form", "gravy_session_fields_put", "hipay_vault_token", "juspay_txns.v1", "lyra_krypton_payment", "makecommerce_card_frame", "midtrans_card_token", "moneris_hosted_tokenization", "nexi_checkout_pay", "omise_card_token", "openpay_tokenizer", "paddle_tokenex_pay", "paddle_vgs_cards", "pay_nl_card_token", "payfast_card_pay", "paygent_token", "paymob_checkout_pay", "paymongo_checkout_pay", "paypal_card_fields", "payrails_device_encrypt", "payrexx_card_frame", "paytrail_hosted_payment_page", "payu_latam_webcheckout_card", "pelecard_transaction", "pin_payments_card_token", "poynt_collect_nonce", "primer_payment_instruments", "przelewy24_hosted_payment_page", "quickpay_hosted_payment_page", "redsys_hosted_payment_page", "revolut_card_field", "sbps_token_jsonp", "shiji_sts_pinned_key", "sumup_checkout_process", "tap_card_sdk_token", "toast_pinned_key", "tokenex_iframe_tokenize", "transbank_webpay_hosted_payment_page", "twoc2p_secure_pay", "verifone_card_capture", "wix_payments_tokenize", "worldline_mycheckout_form", "worldpay_eprotect_jsonp", "wspay_confirm", "xendit_card_token"];