@agent-cards/sdk 0.23.25 → 0.23.27

package/dist/client.d.ts

@@ -447,6 +447,18 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * page the create names. Served on the same terms: only to a build that lists it, for a company
  * Agentcard turned Omise on for.
  *
+ * `pin_payments_card_token`: the card request Pin Payments' card fields send, from Hosted Fields'
+ * control frame on cdn.pinpayments.com or from Pin.js on a merchant's own page: a JSON POST to
+ * https://api.pinpayments.com/1/cards (test-api.pinpayments.com in test) under the merchant's
+ * publishable key. This build pauses only the card fields' own body at that exact URL (payment-core
+ * pin-payments.js); a secret key, an amount or any other body there fails in the browser before
+ * anything is created, and the JSONP form and a card's own record are never paused. The cardholder's
+ * device sends the request itself with the real card, and the page gets the token answer
+ * payment-core's judge rebuilt. The request names no amount, so the agent's pair, above zero, is the
+ * one the cardholder approves, and the API pays only a Pin account payment-core pins for the checkout
+ * page the create names. Served on the same terms: only to a build that lists it, for a company
+ * Agentcard turned Pin Payments on for.
+ *
  * `sbps_token_jsonp`: SB Payment Service's card token request, the JSONP <script>
  * GET its token script sends to /token/generateToken on token.sps-system.com. This
  * build pauses it only as the browser writes it, aborts any other request on that
@@ -499,6 +511,17 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * amount, so the agent's pair, above zero, is the one the cardholder approves.
  * Served on the same terms: only to a build that lists it, for a company Agentcard turned APS on for.
  *
+ * `nexi_checkout_pay`: the card payment Nexi Checkout's card frame (checkout.dibspayment.eu/v1/, formerly Nets
+ * Easy) posts as JSON to its own pay endpoint, https://checkout.dibspayment.eu/api/v1/pay (the test host for a
+ * test row), under the merchant's checkout key and the payment's id. This build pauses only the card form's own
+ * body at that exact URL ("save my card", "remember me" and a card fee are refused at the pause, and the frame's
+ * card lookup while the number is typed continues untouched); the cardholder's device reads Nexi's own record of the
+ * payment and sends the card through the checkout relay, and the frame gets Nexi's answer as payment-core's judge
+ * rebuilt it: the payment done, or Nexi's 3-D Secure step, which the frame then runs in the agent's browser. The
+ * body names the payment's amount in minor units but not its currency, so the agent's pair, above zero, is the one
+ * the cardholder approves, and the API holds its amount to the body's. Served on the same terms: only to a build
+ * that lists it, for a company Agentcard turned Nexi Checkout on for.
+ *
  * `barion_hosted_payment_page`: Barion's Smart Gateway, whose card-free link
  * (secure.barion.com/Pay?Id=<payment id>, a plain GET the merchant's redirect or script sends
  * the buyer to) this build pauses for the cardholder's device by its exact link (hosted-entry.ts),
@@ -506,6 +529,30 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * send (pre-claim.ts, barion.ts). Served on the same terms as Przelewy24's: only to a build that
  * lists it, for a company Agentcard turned Barion on for.
  *
+ * `paymob_checkout_pay`: the card payment Paymob's own checkout sends, from Unified Checkout
+ * (<country>.checkout.paymob.com) or from the Pixel card frame a merchant's page embeds, as JSON to
+ * https://<accept|uae|ksa|oman>.paymob.com/api/acceptance/payments/pay. This build pauses only the
+ * card form's own payment at that exact URL: a card Paymob saved, a payment that keeps the card,
+ * pays in installments, splits, converts or names a Paymob account, and a payment key that enrolls
+ * a subscription or names no amount are refused at the pause, and another method's payment with no
+ * card (a wallet, Apple Pay, cash) continues to Paymob untouched. The cardholder's device sends the
+ * payment to Paymob itself with the real card, and the checkout gets Paymob's answer as payment-core's
+ * judge rebuilt it. The payment key names the amount and currency, so an agent pair is optional and
+ * the API holds one to the key's figure. Served on the same terms: only to a build that lists it, for
+ * a company Agentcard turned Paymob on for.
+ *
+ * `payu_latam_webcheckout_card`: the card submit PayU Latam's WebCheckout page posts to
+ * checkout.payulatam.com/ppp-web-gateway-payu/checkout/submit/<country>/credit_card/<key>
+ * (sandbox.checkout.payulatam.com on PayU's test platform). This build pauses only the card form's
+ * own submit at that exact URL (a ticked save-my-card box, a card PayU saved, installments and a
+ * test order on the live host are refused at the pause); the cardholder's device writes the real
+ * card into the paused body and sends it to PayU itself, and the page gets PayU's answer as
+ * payment-core's judge reads it. The page's BIN lookup (checkout/card_info/) carries the typed
+ * placeholder and continues, as the page needs its answer to fill the card's facts. The submit's
+ * copy of the order is the browser's, so the agent's pair, above zero, is the one the cardholder
+ * approves, which the API holds to the order PayU reads back. Served on the same terms: only to a
+ * build that lists it, for a company Agentcard turned PayU Latam on for.
+ *
  * The list itself is capabilities.json, sorted, one per line (scripts/generate-capabilities.mjs).
  */
 export declare const SUPPORTED_CAPABILITIES: readonly string[];

package/dist/client.js

@@ -440,6 +440,18 @@ export const SUPPORTED_REGISTRY_FEATURES = ['card_fields', 'checkout_sessions'];
  * page the create names. Served on the same terms: only to a build that lists it, for a company
  * Agentcard turned Omise on for.
  *
+ * `pin_payments_card_token`: the card request Pin Payments' card fields send, from Hosted Fields'
+ * control frame on cdn.pinpayments.com or from Pin.js on a merchant's own page: a JSON POST to
+ * https://api.pinpayments.com/1/cards (test-api.pinpayments.com in test) under the merchant's
+ * publishable key. This build pauses only the card fields' own body at that exact URL (payment-core
+ * pin-payments.js); a secret key, an amount or any other body there fails in the browser before
+ * anything is created, and the JSONP form and a card's own record are never paused. The cardholder's
+ * device sends the request itself with the real card, and the page gets the token answer
+ * payment-core's judge rebuilt. The request names no amount, so the agent's pair, above zero, is the
+ * one the cardholder approves, and the API pays only a Pin account payment-core pins for the checkout
+ * page the create names. Served on the same terms: only to a build that lists it, for a company
+ * Agentcard turned Pin Payments on for.
+ *
  * `sbps_token_jsonp`: SB Payment Service's card token request, the JSONP <script>
  * GET its token script sends to /token/generateToken on token.sps-system.com. This
  * build pauses it only as the browser writes it, aborts any other request on that
@@ -492,6 +504,17 @@ export const SUPPORTED_REGISTRY_FEATURES = ['card_fields', 'checkout_sessions'];
  * amount, so the agent's pair, above zero, is the one the cardholder approves.
  * Served on the same terms: only to a build that lists it, for a company Agentcard turned APS on for.
  *
+ * `nexi_checkout_pay`: the card payment Nexi Checkout's card frame (checkout.dibspayment.eu/v1/, formerly Nets
+ * Easy) posts as JSON to its own pay endpoint, https://checkout.dibspayment.eu/api/v1/pay (the test host for a
+ * test row), under the merchant's checkout key and the payment's id. This build pauses only the card form's own
+ * body at that exact URL ("save my card", "remember me" and a card fee are refused at the pause, and the frame's
+ * card lookup while the number is typed continues untouched); the cardholder's device reads Nexi's own record of the
+ * payment and sends the card through the checkout relay, and the frame gets Nexi's answer as payment-core's judge
+ * rebuilt it: the payment done, or Nexi's 3-D Secure step, which the frame then runs in the agent's browser. The
+ * body names the payment's amount in minor units but not its currency, so the agent's pair, above zero, is the one
+ * the cardholder approves, and the API holds its amount to the body's. Served on the same terms: only to a build
+ * that lists it, for a company Agentcard turned Nexi Checkout on for.
+ *
  * `barion_hosted_payment_page`: Barion's Smart Gateway, whose card-free link
  * (secure.barion.com/Pay?Id=<payment id>, a plain GET the merchant's redirect or script sends
  * the buyer to) this build pauses for the cardholder's device by its exact link (hosted-entry.ts),
@@ -499,6 +522,30 @@ export const SUPPORTED_REGISTRY_FEATURES = ['card_fields', 'checkout_sessions'];
  * send (pre-claim.ts, barion.ts). Served on the same terms as Przelewy24's: only to a build that
  * lists it, for a company Agentcard turned Barion on for.
  *
+ * `paymob_checkout_pay`: the card payment Paymob's own checkout sends, from Unified Checkout
+ * (<country>.checkout.paymob.com) or from the Pixel card frame a merchant's page embeds, as JSON to
+ * https://<accept|uae|ksa|oman>.paymob.com/api/acceptance/payments/pay. This build pauses only the
+ * card form's own payment at that exact URL: a card Paymob saved, a payment that keeps the card,
+ * pays in installments, splits, converts or names a Paymob account, and a payment key that enrolls
+ * a subscription or names no amount are refused at the pause, and another method's payment with no
+ * card (a wallet, Apple Pay, cash) continues to Paymob untouched. The cardholder's device sends the
+ * payment to Paymob itself with the real card, and the checkout gets Paymob's answer as payment-core's
+ * judge rebuilt it. The payment key names the amount and currency, so an agent pair is optional and
+ * the API holds one to the key's figure. Served on the same terms: only to a build that lists it, for
+ * a company Agentcard turned Paymob on for.
+ *
+ * `payu_latam_webcheckout_card`: the card submit PayU Latam's WebCheckout page posts to
+ * checkout.payulatam.com/ppp-web-gateway-payu/checkout/submit/<country>/credit_card/<key>
+ * (sandbox.checkout.payulatam.com on PayU's test platform). This build pauses only the card form's
+ * own submit at that exact URL (a ticked save-my-card box, a card PayU saved, installments and a
+ * test order on the live host are refused at the pause); the cardholder's device writes the real
+ * card into the paused body and sends it to PayU itself, and the page gets PayU's answer as
+ * payment-core's judge reads it. The page's BIN lookup (checkout/card_info/) carries the typed
+ * placeholder and continues, as the page needs its answer to fill the card's facts. The submit's
+ * copy of the order is the browser's, so the agent's pair, above zero, is the one the cardholder
+ * approves, which the API holds to the order PayU reads back. Served on the same terms: only to a
+ * build that lists it, for a company Agentcard turned PayU Latam on for.
+ *
  * The list itself is capabilities.json, sorted, one per line (scripts/generate-capabilities.mjs).
  */
 export const SUPPORTED_CAPABILITIES = DECLARED_CAPABILITIES;
@@ -602,6 +649,8 @@ export const SUPPORTED_CAPABILITIES = DECLARED_CAPABILITIES;
  * create route's refusal, not in this comment.
  */
 const REVOLUT_PSP = 'revolut';
+/** Nexi Checkout's card payment names the payment's amount in minor units but not its currency, as Revolut's does. */
+const NEXI_CHECKOUT_PSP = 'nexi_checkout';
 const AGENT_AMOUNT_PROCESSORS = AGENT_AMOUNT.processors;
 /** The ones a zero amount is refused for, like a missing one (authorize()). */
 const ABOVE_ZERO_PROCESSORS = AGENT_AMOUNT.aboveZero;
@@ -888,7 +937,7 @@ export class AmountRequiredError extends Error {
     constructor(psp) {
         const processor = PROCESSOR_NAMES[psp] ?? psp;
         // A Payrexx card request names the frame's total, but the merchant's page charges its own total after the token.
-        const lacks = psp === REVOLUT_PSP ? 'names its amount but not its currency'
+        const lacks = psp === REVOLUT_PSP || psp === NEXI_CHECKOUT_PSP ? 'names its amount but not its currency'
             : psp === PAYREXX_PSP ? "only mints a token the merchant's page charges later"
                 : psp === TAP_PAYMENTS_PSP ? 'does not decide the amount charged' : 'names no amount';
         // "An Omise payment request", "A Clover payment request": the article follows the name's first letter.

package/dist/merchant-card-endpoints.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 7b5770020fc598b9f1fdfc842ef761812943269a1bd368d4751f99c1ffad7a17
+// artifact-sha256: fedc712140db2d5651bed3391ac158d67dc04d8be58db9926ed328e9be20eb1b
 // src/json-path.js
 var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function isPlainObject(v) {
@@ -2412,6 +2412,73 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         charge_timing: "deferred",
         once_per: { query: "cartId" },
         pending: ["the exporch form, never seen live: a HAR of a cart AT&T sends to /msapi/checkoutexporch/v1"]
+    },
+    {
+        id: "nike_paymentcc_store",
+        merchant: "Nike",
+        status: "observe",
+        evidence: [
+            "www.nike.com guest checkout, read live on Oct 23, 2026 in a Kernel browser with every non-GET request aborted before it left (a placeholder card, nothing sent): the card is typed into Nike's own card frame, https://paymentcc.nike.com/services/default?id=<creditCardInfoId>&ctx=…&language=…&maskerEnabled=…, a form #creditCardForm with #creditCardNumber, #expirationDate (MM/YY) and #cvNumber and hidden expirationMonth and expirationYear. No processor frame, tokenizer or client-side encryption is on the page.",
+            "The frame's own script (/resources/js/common.js) posts the card once all three fields are valid, on a field's blur or keyup, with no button press: XHR POST /creditcardsubmit/<creditCardInfoId>/store, Content-Type application/json; charset=utf-8, body {accountNumber (digits), cardType, expirationMonth (MM), expirationYear ('20' + YY), creditCardInfoId (the frame's id query value, the same as the path), cvNumber}. The captured request carried the .nike.com cookies (Akamai's ak_bmsc and bm_sv among them), Origin https://paymentcc.nike.com, and no CSRF or auth header.",
+            "cardType comes from the frame's own validator table, first match wins: AMERICANEXPRESS (34, 37), CARTASI (a list of Italian 4 and 5 BINs), CARTEBLEUE, DANKORT, DISCOVER, DINERS, DOMESTICMAESTRO, INTERNATIONALMAESTRO, JCB, MASTERCARD (51-55 and 2221-2720), VISAELECTRON, VISA (4).",
+            "After the post the frame asks GET /creditcardsubmit/<id>/isValid?mode=1 and tells the page its brand, last four and expiry by postMessage. A CVV-only change sends PUT /creditcardsubmit/<id>/update {cvNumber}. Continue to Order Review then posts https://api.nike.com/payment/preview/v3 with paymentInfo naming the creditCardInfoId, the brand, the last four and a masked accountNumber, beside the checkout total and currency: no card number leaves the page outside the store request."
+        ],
+        har: null,
+        checkout: "https://www.nike.com",
+        checkout_frame: false,
+        frame: "https://paymentcc.nike.com",
+        endpoint: "https://paymentcc.nike.com",
+        method: "POST",
+        path: "/creditcardsubmit/:creditCardInfoId/store",
+        query: {},
+        navigation: null,
+        encoding: "json",
+        session: {
+            cookies: true,
+            cookie_names: null,
+            headers: [...BROWSER_HEADERS, "content-type"],
+            required: []
+        },
+        card: {
+            pan: { at: ["accountNumber"], format: "digits" },
+            cvv: { at: ["cvNumber"], format: "digits" },
+            exp_month: { at: ["expirationMonth"], format: "mm" },
+            exp_year: { at: ["expirationYear"], format: "yyyy" },
+            expiry: null,
+            last4: null,
+            leading: null,
+            brands: [{ at: ["cardType"], map: { visa: "VISA", mastercard: "MASTERCARD", amex: "AMERICANEXPRESS", discover: "DISCOVER" } }],
+            bins: null
+        },
+        merchant_key: null,
+        requires: [
+            { at: ["creditCardInfoId"], matches: "guid" },
+            { at: ["creditCardInfoId"], equals_path: "creditCardInfoId" }
+        ],
+        refuse: [],
+        payment_method: null,
+        // The store request carries no total: the order's total first travels in payment/preview/v3, after it.
+        amount: null,
+        currency: "USD",
+        response: { headers: ["content-type"], withhold: [] },
+        resends: [
+            // The frame's CVV-only update, which sends the typed security code again outside the store request.
+            { method: "PUT", path: "/creditcardsubmit/:creditCardInfoId/update", query: {} }
+        ],
+        challenge: null,
+        facts: null,
+        // paymentcc.nike.com answers /robots.txt with a 404; the frame's own masking script is a harmless GET it serves.
+        bootstrap: "/resources/js/masker.js",
+        timeout_ms: 3e4,
+        charge_timing: "deferred",
+        once_per: { path: "creditCardInfoId" },
+        pending: [
+            "the answer to the store request (status, body and headers) and to isValid, which this capture aborted before they were sent",
+            "a total to hold the agent's amount to: the store request names none, and Nike's checkout total travels only in payment/preview/v3 after it",
+            "which call authorizes the card (payment/preview/v3 or the order submit), and whether the charge when the order ships needs the card to stay open",
+            "a card the frame names CARTASI, CARTEBLEUE, DANKORT or a Maestro type, which the brand map writes as its network's code",
+            "whether Akamai accepts the relay's request with cookies the agent's browser minted"
+        ]
     }
 ]);
 function wireProjection(profiles) {