@agent-cards/sdk 0.23.26 → 0.23.27

package/CHANGELOG.md

@@ -4,6 +4,12 @@ An unreleased change waits as a file of its own in `changes/` (`changes/README.m
 
 ## Unreleased
 
+## 0.23.27
+
+- Pause Pin Payments' card request for the cardholder's device, for a company Agentcard turned Pin Payments on for. Pin's Hosted Fields (its control frame on `cdn.pinpayments.com`) and Pin.js on a merchant's own page send the card as JSON to `https://api.pinpayments.com/1/cards` under the merchant's publishable key, and Pin answers with a card token the merchant's server charges afterwards. The sync now also asks for `capabilities=pin_payments_card_token`, and the API serves Pin's recognizer only for a company Agentcard turned Pin on for. The SDK pauses only the card fields' own request at that exact URL: a secret key, an amount or any other body there fails in your browser before anything is created, and Pin's JSONP form and a card's own record are never paused. The cardholder's device sends the request to Pin itself with the real card, and the page gets Pin's card token. Pin's request names no price, so pass `amount` and `currency`, above zero: without them `authorize()` throws `AmountRequiredError` before anything is created. The API pays only a Pin account Agentcard reviewed for the checkout page the request comes from. Matching API and Vault releases are required. Pin Payments stays off for every company Agentcard has not turned it on for.
+
+- Stop the card request Nike's checkout sends from its own card frame. Nike's guest checkout on `www.nike.com` takes the card in a frame on `paymentcc.nike.com`, and that frame posts it, once the three fields are valid and before any button is pressed, to `https://paymentcc.nike.com/creditcardsubmit/<creditCardInfoId>/store`. No processor is on the page, so before this change nothing armed that request. The adapters now pause it and refuse it as `unsupported_checkout` while Nike's profile, `nike_paymentcc_store`, is in `observe`, so the agent's dummy card never reaches Nike. The frame's security code update, a `PUT` to `/creditcardsubmit/<creditCardInfoId>/update`, is aborted in every status as `card_endpoint_refused` with reason `card_resend`. The profile reads the body the frame builds: `accountNumber`, `cardType` one of `VISA`, `MASTERCARD`, `AMERICANEXPRESS` or `DISCOVER`, a two-digit `expirationMonth`, a four-digit `expirationYear`, `cvNumber`, and a `creditCardInfoId` equal to the one in the URL.
+
 ## 0.23.26
 
 - Pause Paymob's card payment for the cardholder's device. Paymob's own checkout in Egypt, the UAE, Saudi Arabia and Oman, Unified Checkout on `<country>.checkout.paymob.com` (where Paymob's payment links and its WooCommerce redirects land) and the Pixel card frame a merchant's page embeds, posts the card as JSON to `https://<accept|uae|ksa|oman>.paymob.com/api/acceptance/payments/pay` with the merchant's payment key. The sync now also asks for `capabilities=paymob_checkout_pay`, and the API serves Paymob's recognizer only for a company Agentcard turned Paymob on for. The SDK pauses only the card form's own payment at that exact URL: a card Paymob saved, a payment that keeps the card, pays in installments, splits the amount, converts its currency or names a Paymob account, and a payment key that enrolls a subscription or names no amount are refused at the pause, and another method's payment with no card (a wallet, Apple Pay, cash) continues to Paymob untouched. The cardholder's device sends the payment to Paymob itself with the real card, and the checkout gets Paymob's answer and runs 3-D Secure in the agent's browser. The payment key names the amount and currency, so `amount` and `currency` are optional; a pair you pass must match the key's. The API and the Vault already carry Paymob's side. Paymob stays off for every company Agentcard has not turned it on for.
@@ -12,6 +18,8 @@ An unreleased change waits as a file of its own in `changes/` (`changes/README.m
 
 - Stop continuing Tap Payments' card token request for any merchant. Casefilegame, the Bahrain store that was the one Tap merchant Agentcard had reviewed, is no longer listed: since 2026-10-22 every page of that store shows a fake security check that tells a Mac visitor to open Terminal and paste a command. This build's copy of Agentcard's checkout rules lists no Tap merchant, so the SDK writes the device's ciphertext into no Tap token request, and an approved one fails in the agent's browser instead of continuing. The API already refuses the create for a Tap card form with `unsupported_checkout` (reason `tap_payments_merchant_unreviewed`) before anyone is asked, whatever SDK version sends it. Every other processor is unchanged.
 
+- Pay a Nexi Checkout card payment through the checkout relay, for a company Agentcard turns Nexi Checkout on for (dark launch). Nexi Checkout (formerly Nets Easy, used by Danish, Norwegian, Swedish and Finnish merchants) takes the card in its own card frame, which posts it to `https://checkout.dibspayment.eu/api/v1/pay` under the merchant's checkout key. This build declares `nexi_checkout_pay` on every sync, and the API serves the Nexi entry only to a company Agentcard turned Nexi Checkout on for, so every other company's Nexi payments go through untouched, as for an unsupported processor. For an enabled company the SDK pauses only the card form's own payment; a post with "save my card", "remember me" or a card fee is refused before anything is sent, and the frame's card lookup while the number is typed continues untouched. The payment names its amount in minor units but not its currency, so `authorize()` refuses one without `amount` above zero and `currency` (`AmountRequiredError`): send the total the checkout shows. The SDK sends the checkout page's origin as `checkout_origin` (`https://checkout.dibspayment.eu` for Nexi's hosted page), and the API pays only a merchant reviewed for that page. The cardholder's device reads Nexi's own record of the payment and sends the card through the checkout relay, and the frame gets Nexi's answer: the payment done, or Nexi's 3-D Secure step, which the frame runs in the agent's browser, where a challenge needs a person at that browser. A Nexi payment also needs the matching API, Vault and checkout relay releases, and a merchant Agentcard reviewed.
+
 ## 0.23.25
 
 - Pause Barion's Smart Gateway (where Hungarian, Czech and Slovak shops send a buyer who pays by card) for the cardholder's device. The sync now also asks for `capabilities=barion_hosted_payment_page`, and the API serves Barion's recognizer only for a company Agentcard turned Barion on for. The SDK pauses the gateway link, `https://secure.barion.com/Pay?Id=<payment id>` (or `secure.test.barion.com` for a test payment), which carries no card, as a `hosted_form` authorization, and answers the paused navigation with the `submitted_on_device` page once the cardholder's device has paid it. The API takes a Barion entry only from the checkout page of a shop Agentcard reviewed, the page the SDK names as `checkout_origin`. The link names no amount, so send the total Barion's gateway shows, with its currency: `authorize()` throws `AmountRequiredError` without it, and the API refuses a create without one (`amount_required`). A merchant's server usually sends the buyer to the gateway with a redirect, and only `attachToCdp` pauses a redirect, so attach to a Barion checkout with `attachToCdp`. Every post a page the SDK watches makes to the gateway, such as its email check and its card posts, leads to a card: the SDK fails each one and reads `unsupported` with reason `processor_card_page`. Matching API and Vault releases are required, and no Barion shop is reviewed yet. Barion stays off for every company Agentcard has not turned it on for.

package/README.md

@@ -301,7 +301,7 @@ so new processors work without you shipping a release. `attachToCdp` derives the
 `Fetch.enable` url patterns from that same list rather than a constant, which is
 why the sync call belongs before the attach. `agentcard.checkout.cardUrlPatterns()` returns
 those patterns if you arm a CDP connection yourself. Call
-`GET /v2/checkout/recognizers?modes=token,cse,hosted_form,device_encrypt&capabilities=fiserv_card_capture,gmo_shared_pk,capture_context,juspay_txns.v1,datatrans_secure_fields_tokenize,authorize_net_dpm_form,pelecard_transaction,aci_split_card.v1,creditguard_pps_process,primer_payment_instruments,payrails_device_encrypt,converge_hpp_process,worldpay_eprotect_jsonp,wspay_confirm,shiji_sts_pinned_key,amadeus_checkout_actions.v1,worldline_mycheckout_form,verifone_card_capture,ekashu_hosted_payment_page,cybersource_sa_token_create,gravy_session_fields_put,moneris_hosted_tokenization,paddle_vgs_cards,paddle_tokenex_pay,redsys_hosted_payment_page,lyra_krypton_payment,payfast_card_pay,wix_payments_tokenize,paymongo_checkout_pay,paygent_token,pay_nl_card_token,hipay_vault_token,twoc2p_secure_pay,quickpay_hosted_payment_page,revolut_card_field,paypal_card_fields,gopay_card_form,payrexx_card_frame,comgate_hosted_payment_page,przelewy24_hosted_payment_page,makecommerce_card_frame,poynt_collect_nonce,tokenex_iframe_tokenize,transbank_webpay_hosted_payment_page,sumup_checkout_process,clover_card_token,eximbay_hosted_payment_page,toast_pinned_key,xendit_card_token,omise_card_token,paytrail_hosted_payment_page,fastspring_card_payment,openpay_tokenizer,barion_hosted_payment_page,paymob_checkout_pay,payu_latam_webcheckout_card,nexi_checkout_pay`
+`GET /v2/checkout/recognizers?modes=token,cse,hosted_form,device_encrypt&capabilities=fiserv_card_capture,gmo_shared_pk,capture_context,juspay_txns.v1,datatrans_secure_fields_tokenize,authorize_net_dpm_form,pelecard_transaction,aci_split_card.v1,creditguard_pps_process,primer_payment_instruments,payrails_device_encrypt,converge_hpp_process,worldpay_eprotect_jsonp,wspay_confirm,shiji_sts_pinned_key,amadeus_checkout_actions.v1,worldline_mycheckout_form,verifone_card_capture,ekashu_hosted_payment_page,cybersource_sa_token_create,gravy_session_fields_put,moneris_hosted_tokenization,paddle_vgs_cards,paddle_tokenex_pay,redsys_hosted_payment_page,lyra_krypton_payment,payfast_card_pay,wix_payments_tokenize,paymongo_checkout_pay,paygent_token,pay_nl_card_token,hipay_vault_token,twoc2p_secure_pay,quickpay_hosted_payment_page,revolut_card_field,paypal_card_fields,gopay_card_form,payrexx_card_frame,comgate_hosted_payment_page,przelewy24_hosted_payment_page,makecommerce_card_frame,poynt_collect_nonce,tokenex_iframe_tokenize,transbank_webpay_hosted_payment_page,sumup_checkout_process,clover_card_token,eximbay_hosted_payment_page,toast_pinned_key,xendit_card_token,omise_card_token,paytrail_hosted_payment_page,fastspring_card_payment,openpay_tokenizer,barion_hosted_payment_page,paymob_checkout_pay,payu_latam_webcheckout_card,nexi_checkout_pay,pin_payments_card_token`
 for the list this build syncs. The API serves Fiserv's card capture only to a
 build that lists `fiserv_card_capture`, and only for a company Agentcard turned
 Fiserv on for. An older SDK never pauses a Fiserv request it could not finish,
@@ -429,6 +429,14 @@ page, the cardholder's device sends it to Omise itself with the real card, and
 the page gets Omise's token. The API pays only a merchant Agentcard reviewed
 for the page the request comes from. Omise's request names no price, so pass
 `amount` and `currency`, above zero: that is the amount the cardholder approves.
+Pin Payments' card request (`pin_payments_card_token`) is served on the same
+terms: this build pauses the card request Pin's Hosted Fields or Pin.js sends to
+`https://api.pinpayments.com/1/cards`, the cardholder's device sends it to Pin
+itself with the real card, and the page gets Pin's card token, which the
+merchant's server charges afterwards. The API pays only a Pin account Agentcard
+reviewed for the page the request comes from. Pin's request names no price, so
+pass `amount` and `currency`, above zero: that is the amount the cardholder
+approves.
 FastSpring's checkout (`fastspring_card_payment`) is served on the same terms:
 this build pauses the card payment the checkout posts to
 `<store>.onfastspring.com/.../session/<id>/payment`, the cardholder's device

package/dist/agent-amount.generated.js

@@ -1,3 +1,3 @@
 // Written by scripts/generate-agent-amount.mjs from agent-amount-processors.json. Do not edit; git ignores it.
 /** agent-amount-processors.json, sorted; client.ts reads its amount tables from it. */
-export const AGENT_AMOUNT = { "processors": ["amazon_payment_services", "barion", "clover", "comgate", "cybersource_secure_acceptance", "fastspring", "gmo_pg", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "nexi_checkout", "omise", "openpay_bbva", "paddle_vgs", "pay_nl", "payfast", "paygent", "paymongo", "paypal", "payrexx", "paytrail", "payu_latam", "pelecard", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p", "wix_payments", "wspay"], "aboveZero": ["amazon_payment_services", "barion", "clover", "comgate", "fastspring", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "nexi_checkout", "omise", "openpay_bbva", "pay_nl", "payfast", "paymongo", "paypal", "payrexx", "payu_latam", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p"], "pageAmount": ["pelecard", "sb_payment_service"], "names": { "amazon_payment_services": "Amazon Payment Services", "barion": "Barion", "clover": "Clover", "comgate": "ComGate", "cybersource_secure_acceptance": "CyberSource Secure Acceptance", "fastspring": "FastSpring", "gmo_pg": "GMO", "gopay": "GoPay", "hipay": "HiPay", "makecommerce": "MakeCommerce", "midtrans": "Midtrans", "moneris": "Moneris", "nexi_checkout": "Nexi Checkout", "omise": "Omise", "openpay_bbva": "Openpay", "paddle_vgs": "Paddle", "pay_nl": "Pay.", "payfast": "Payfast", "paygent": "Paygent", "paymongo": "PayMongo", "paypal": "PayPal", "payrexx": "Payrexx", "paytrail": "Paytrail", "payu_latam": "PayU Latam", "pelecard": "Pelecard", "poynt": "GoDaddy Payments", "przelewy24": "Przelewy24", "revolut": "Revolut", "sb_payment_service": "SB Payment Service", "sumup": "SumUp", "tap_payments": "Tap", "toast": "Toast", "tokenex_iframe": "TokenEx", "transbank_webpay": "Webpay", "twoc2p": "2C2P", "wix_payments": "Wix", "wspay": "WSPay" } };
+export const AGENT_AMOUNT = { "processors": ["amazon_payment_services", "barion", "clover", "comgate", "cybersource_secure_acceptance", "fastspring", "gmo_pg", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "nexi_checkout", "omise", "openpay_bbva", "paddle_vgs", "pay_nl", "payfast", "paygent", "paymongo", "paypal", "payrexx", "paytrail", "payu_latam", "pelecard", "pin_payments", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p", "wix_payments", "wspay"], "aboveZero": ["amazon_payment_services", "barion", "clover", "comgate", "fastspring", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "nexi_checkout", "omise", "openpay_bbva", "pay_nl", "payfast", "paymongo", "paypal", "payrexx", "payu_latam", "pin_payments", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p"], "pageAmount": ["pelecard", "sb_payment_service"], "names": { "amazon_payment_services": "Amazon Payment Services", "barion": "Barion", "clover": "Clover", "comgate": "ComGate", "cybersource_secure_acceptance": "CyberSource Secure Acceptance", "fastspring": "FastSpring", "gmo_pg": "GMO", "gopay": "GoPay", "hipay": "HiPay", "makecommerce": "MakeCommerce", "midtrans": "Midtrans", "moneris": "Moneris", "nexi_checkout": "Nexi Checkout", "omise": "Omise", "openpay_bbva": "Openpay", "paddle_vgs": "Paddle", "pay_nl": "Pay.", "payfast": "Payfast", "paygent": "Paygent", "paymongo": "PayMongo", "paypal": "PayPal", "payrexx": "Payrexx", "paytrail": "Paytrail", "payu_latam": "PayU Latam", "pelecard": "Pelecard", "pin_payments": "Pin Payments", "poynt": "GoDaddy Payments", "przelewy24": "Przelewy24", "revolut": "Revolut", "sb_payment_service": "SB Payment Service", "sumup": "SumUp", "tap_payments": "Tap", "toast": "Toast", "tokenex_iframe": "TokenEx", "transbank_webpay": "Webpay", "twoc2p": "2C2P", "wix_payments": "Wix", "wspay": "WSPay" } };

package/dist/capabilities.generated.js

@@ -1,3 +1,3 @@
 // Written by scripts/generate-capabilities.mjs from capabilities.json. Do not edit; git ignores it.
 /** capabilities.json's list, sorted; client.ts exports it as SUPPORTED_CAPABILITIES. */
-export const DECLARED_CAPABILITIES = ["aci_split_card.v1", "amadeus_checkout_actions.v1", "aps_custom_merchant_page", "authorize_net_dpm_form", "barion_hosted_payment_page", "capture_context", "clover_card_token", "comgate_hosted_payment_page", "converge_hpp_process", "creditguard_pps_process", "cybersource_sa_token_create", "datatrans_secure_fields_tokenize", "ekashu_hosted_payment_page", "eximbay_hosted_payment_page", "fastspring_card_payment", "fiserv_card_capture", "gmo_shared_pk", "gopay_card_form", "gravy_session_fields_put", "hipay_vault_token", "juspay_txns.v1", "lyra_krypton_payment", "makecommerce_card_frame", "midtrans_card_token", "moneris_hosted_tokenization", "nexi_checkout_pay", "omise_card_token", "openpay_tokenizer", "paddle_tokenex_pay", "paddle_vgs_cards", "pay_nl_card_token", "payfast_card_pay", "paygent_token", "paymob_checkout_pay", "paymongo_checkout_pay", "paypal_card_fields", "payrails_device_encrypt", "payrexx_card_frame", "paytrail_hosted_payment_page", "payu_latam_webcheckout_card", "pelecard_transaction", "poynt_collect_nonce", "primer_payment_instruments", "przelewy24_hosted_payment_page", "quickpay_hosted_payment_page", "redsys_hosted_payment_page", "revolut_card_field", "sbps_token_jsonp", "shiji_sts_pinned_key", "sumup_checkout_process", "tap_card_sdk_token", "toast_pinned_key", "tokenex_iframe_tokenize", "transbank_webpay_hosted_payment_page", "twoc2p_secure_pay", "verifone_card_capture", "wix_payments_tokenize", "worldline_mycheckout_form", "worldpay_eprotect_jsonp", "wspay_confirm", "xendit_card_token"];
+export const DECLARED_CAPABILITIES = ["aci_split_card.v1", "amadeus_checkout_actions.v1", "aps_custom_merchant_page", "authorize_net_dpm_form", "barion_hosted_payment_page", "capture_context", "clover_card_token", "comgate_hosted_payment_page", "converge_hpp_process", "creditguard_pps_process", "cybersource_sa_token_create", "datatrans_secure_fields_tokenize", "ekashu_hosted_payment_page", "eximbay_hosted_payment_page", "fastspring_card_payment", "fiserv_card_capture", "gmo_shared_pk", "gopay_card_form", "gravy_session_fields_put", "hipay_vault_token", "juspay_txns.v1", "lyra_krypton_payment", "makecommerce_card_frame", "midtrans_card_token", "moneris_hosted_tokenization", "nexi_checkout_pay", "omise_card_token", "openpay_tokenizer", "paddle_tokenex_pay", "paddle_vgs_cards", "pay_nl_card_token", "payfast_card_pay", "paygent_token", "paymob_checkout_pay", "paymongo_checkout_pay", "paypal_card_fields", "payrails_device_encrypt", "payrexx_card_frame", "paytrail_hosted_payment_page", "payu_latam_webcheckout_card", "pelecard_transaction", "pin_payments_card_token", "poynt_collect_nonce", "primer_payment_instruments", "przelewy24_hosted_payment_page", "quickpay_hosted_payment_page", "redsys_hosted_payment_page", "revolut_card_field", "sbps_token_jsonp", "shiji_sts_pinned_key", "sumup_checkout_process", "tap_card_sdk_token", "toast_pinned_key", "tokenex_iframe_tokenize", "transbank_webpay_hosted_payment_page", "twoc2p_secure_pay", "verifone_card_capture", "wix_payments_tokenize", "worldline_mycheckout_form", "worldpay_eprotect_jsonp", "wspay_confirm", "xendit_card_token"];

package/dist/client.d.ts

@@ -447,6 +447,18 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * page the create names. Served on the same terms: only to a build that lists it, for a company
  * Agentcard turned Omise on for.
  *
+ * `pin_payments_card_token`: the card request Pin Payments' card fields send, from Hosted Fields'
+ * control frame on cdn.pinpayments.com or from Pin.js on a merchant's own page: a JSON POST to
+ * https://api.pinpayments.com/1/cards (test-api.pinpayments.com in test) under the merchant's
+ * publishable key. This build pauses only the card fields' own body at that exact URL (payment-core
+ * pin-payments.js); a secret key, an amount or any other body there fails in the browser before
+ * anything is created, and the JSONP form and a card's own record are never paused. The cardholder's
+ * device sends the request itself with the real card, and the page gets the token answer
+ * payment-core's judge rebuilt. The request names no amount, so the agent's pair, above zero, is the
+ * one the cardholder approves, and the API pays only a Pin account payment-core pins for the checkout
+ * page the create names. Served on the same terms: only to a build that lists it, for a company
+ * Agentcard turned Pin Payments on for.
+ *
  * `sbps_token_jsonp`: SB Payment Service's card token request, the JSONP <script>
  * GET its token script sends to /token/generateToken on token.sps-system.com. This
  * build pauses it only as the browser writes it, aborts any other request on that

package/dist/client.js

@@ -440,6 +440,18 @@ export const SUPPORTED_REGISTRY_FEATURES = ['card_fields', 'checkout_sessions'];
  * page the create names. Served on the same terms: only to a build that lists it, for a company
  * Agentcard turned Omise on for.
  *
+ * `pin_payments_card_token`: the card request Pin Payments' card fields send, from Hosted Fields'
+ * control frame on cdn.pinpayments.com or from Pin.js on a merchant's own page: a JSON POST to
+ * https://api.pinpayments.com/1/cards (test-api.pinpayments.com in test) under the merchant's
+ * publishable key. This build pauses only the card fields' own body at that exact URL (payment-core
+ * pin-payments.js); a secret key, an amount or any other body there fails in the browser before
+ * anything is created, and the JSONP form and a card's own record are never paused. The cardholder's
+ * device sends the request itself with the real card, and the page gets the token answer
+ * payment-core's judge rebuilt. The request names no amount, so the agent's pair, above zero, is the
+ * one the cardholder approves, and the API pays only a Pin account payment-core pins for the checkout
+ * page the create names. Served on the same terms: only to a build that lists it, for a company
+ * Agentcard turned Pin Payments on for.
+ *
  * `sbps_token_jsonp`: SB Payment Service's card token request, the JSONP <script>
  * GET its token script sends to /token/generateToken on token.sps-system.com. This
  * build pauses it only as the browser writes it, aborts any other request on that

package/dist/merchant-card-endpoints.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 7b5770020fc598b9f1fdfc842ef761812943269a1bd368d4751f99c1ffad7a17
+// artifact-sha256: fedc712140db2d5651bed3391ac158d67dc04d8be58db9926ed328e9be20eb1b
 // src/json-path.js
 var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function isPlainObject(v) {
@@ -2412,6 +2412,73 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         charge_timing: "deferred",
         once_per: { query: "cartId" },
         pending: ["the exporch form, never seen live: a HAR of a cart AT&T sends to /msapi/checkoutexporch/v1"]
+    },
+    {
+        id: "nike_paymentcc_store",
+        merchant: "Nike",
+        status: "observe",
+        evidence: [
+            "www.nike.com guest checkout, read live on Oct 23, 2026 in a Kernel browser with every non-GET request aborted before it left (a placeholder card, nothing sent): the card is typed into Nike's own card frame, https://paymentcc.nike.com/services/default?id=<creditCardInfoId>&ctx=…&language=…&maskerEnabled=…, a form #creditCardForm with #creditCardNumber, #expirationDate (MM/YY) and #cvNumber and hidden expirationMonth and expirationYear. No processor frame, tokenizer or client-side encryption is on the page.",
+            "The frame's own script (/resources/js/common.js) posts the card once all three fields are valid, on a field's blur or keyup, with no button press: XHR POST /creditcardsubmit/<creditCardInfoId>/store, Content-Type application/json; charset=utf-8, body {accountNumber (digits), cardType, expirationMonth (MM), expirationYear ('20' + YY), creditCardInfoId (the frame's id query value, the same as the path), cvNumber}. The captured request carried the .nike.com cookies (Akamai's ak_bmsc and bm_sv among them), Origin https://paymentcc.nike.com, and no CSRF or auth header.",
+            "cardType comes from the frame's own validator table, first match wins: AMERICANEXPRESS (34, 37), CARTASI (a list of Italian 4 and 5 BINs), CARTEBLEUE, DANKORT, DISCOVER, DINERS, DOMESTICMAESTRO, INTERNATIONALMAESTRO, JCB, MASTERCARD (51-55 and 2221-2720), VISAELECTRON, VISA (4).",
+            "After the post the frame asks GET /creditcardsubmit/<id>/isValid?mode=1 and tells the page its brand, last four and expiry by postMessage. A CVV-only change sends PUT /creditcardsubmit/<id>/update {cvNumber}. Continue to Order Review then posts https://api.nike.com/payment/preview/v3 with paymentInfo naming the creditCardInfoId, the brand, the last four and a masked accountNumber, beside the checkout total and currency: no card number leaves the page outside the store request."
+        ],
+        har: null,
+        checkout: "https://www.nike.com",
+        checkout_frame: false,
+        frame: "https://paymentcc.nike.com",
+        endpoint: "https://paymentcc.nike.com",
+        method: "POST",
+        path: "/creditcardsubmit/:creditCardInfoId/store",
+        query: {},
+        navigation: null,
+        encoding: "json",
+        session: {
+            cookies: true,
+            cookie_names: null,
+            headers: [...BROWSER_HEADERS, "content-type"],
+            required: []
+        },
+        card: {
+            pan: { at: ["accountNumber"], format: "digits" },
+            cvv: { at: ["cvNumber"], format: "digits" },
+            exp_month: { at: ["expirationMonth"], format: "mm" },
+            exp_year: { at: ["expirationYear"], format: "yyyy" },
+            expiry: null,
+            last4: null,
+            leading: null,
+            brands: [{ at: ["cardType"], map: { visa: "VISA", mastercard: "MASTERCARD", amex: "AMERICANEXPRESS", discover: "DISCOVER" } }],
+            bins: null
+        },
+        merchant_key: null,
+        requires: [
+            { at: ["creditCardInfoId"], matches: "guid" },
+            { at: ["creditCardInfoId"], equals_path: "creditCardInfoId" }
+        ],
+        refuse: [],
+        payment_method: null,
+        // The store request carries no total: the order's total first travels in payment/preview/v3, after it.
+        amount: null,
+        currency: "USD",
+        response: { headers: ["content-type"], withhold: [] },
+        resends: [
+            // The frame's CVV-only update, which sends the typed security code again outside the store request.
+            { method: "PUT", path: "/creditcardsubmit/:creditCardInfoId/update", query: {} }
+        ],
+        challenge: null,
+        facts: null,
+        // paymentcc.nike.com answers /robots.txt with a 404; the frame's own masking script is a harmless GET it serves.
+        bootstrap: "/resources/js/masker.js",
+        timeout_ms: 3e4,
+        charge_timing: "deferred",
+        once_per: { path: "creditCardInfoId" },
+        pending: [
+            "the answer to the store request (status, body and headers) and to isValid, which this capture aborted before they were sent",
+            "a total to hold the agent's amount to: the store request names none, and Nike's checkout total travels only in payment/preview/v3 after it",
+            "which call authorizes the card (payment/preview/v3 or the order submit), and whether the charge when the order ships needs the card to stay open",
+            "a card the frame names CARTASI, CARTEBLEUE, DANKORT or a Maestro type, which the brand map writes as its network's code",
+            "whether Akamai accepts the relay's request with cookies the agent's browser minted"
+        ]
     }
 ]);
 function wireProjection(profiles) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.26",
+  "version": "0.23.27",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",
@@ -30,7 +30,7 @@
     "_comment_test": "check:built runs first and names the command when a file the build generates (the copies in src/, the preflight contracts in dist/, the Kernel inventory) is missing or stale; verify:pack runs last, on the same dist.",
     "check:built": "node scripts/generate-payment-core.mjs --check && node scripts/generate-voice-stream.mjs --check && node scripts/generate-url-masks.mjs --check && node scripts/generate-capabilities.mjs --check && node scripts/generate-agent-amount.mjs --check && node scripts/generate-preflight-contract.mjs --check && node scripts/generate-kernel-native-inventory.mjs --check",
     "verify:pack": "node scripts/verify-pack.mjs",
-    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paytrail.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs payrexx.test.mjs payrexx-follow-ups.test.mjs payrexx-adapters.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs openpay.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs sbps.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs gopay.test.mjs paygent.test.mjs twoc2p.test.mjs tap-payments.test.mjs pay-nl.test.mjs toast.test.mjs redact-url.test.mjs hosted-entry.test.mjs comgate.test.mjs przelewy24.test.mjs tokenex-iframe.test.mjs transbank.test.mjs sumup.test.mjs clover.test.mjs eximbay.test.mjs xendit.test.mjs omise.test.mjs fastspring.test.mjs amazon-payment-services.test.mjs barion.test.mjs paymob.test.mjs payu-latam.test.mjs nexi-checkout.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs browser-tests.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
+    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paytrail.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs payrexx.test.mjs payrexx-follow-ups.test.mjs payrexx-adapters.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs openpay.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs sbps.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs gopay.test.mjs paygent.test.mjs twoc2p.test.mjs tap-payments.test.mjs pay-nl.test.mjs toast.test.mjs redact-url.test.mjs hosted-entry.test.mjs comgate.test.mjs przelewy24.test.mjs tokenex-iframe.test.mjs transbank.test.mjs sumup.test.mjs clover.test.mjs eximbay.test.mjs xendit.test.mjs omise.test.mjs fastspring.test.mjs amazon-payment-services.test.mjs barion.test.mjs paymob.test.mjs payu-latam.test.mjs nexi-checkout.test.mjs pin-payments.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs browser-tests.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
     "test:browser": "node browser-tests.mjs",
     "check:payment-core": "node scripts/generate-payment-core.mjs --check",
     "check:voice-stream": "node scripts/generate-voice-stream.mjs --check",