@flopay/js 1.9.14 → 1.9.16

package/README.md

@@ -329,6 +329,40 @@ try {
 }
 ```
 
+### Server-side card gateways (Worldpay)
+
+The billing API can process hosted-vault cards through an approved Worldpay
+Corporate Gateway entirely server-side (TeamFloPay/backend#1563). Whether a
+session can use it is the billing API's decision, made from the merchant's
+active gateways and their Operations-approved capability record
+(TeamFloPay/backend#1641). `PaymentAPI` sends no capability token, gateway
+hint, or provider selection on any create, so the same request works for every
+SDK version and integration style. Everything stays provider-neutral, so
+existing integrations change nothing:
+
+- Cards still go through the hosted vault widget, from the embedded `vault`
+  block or `getVaultCapture()`. There is no Worldpay browser SDK, key, or
+  credential: `gateways.worldpayCorporateGateway` carries
+  `publishableKey: null` and no enabled methods, and it never appears in the
+  normalized `providers` list.
+- Outcomes arrive as the same `complete` / `decline` / `error` widget events.
+  Declines carry Flo's decline taxonomy, never a raw refusal code. An ambiguous
+  submission stays pending until the billing API reconciles it; the hosted form
+  reports that as an `error`, never a success, and a later session read returns
+  the reconciled status.
+- In the merged billing API version, Worldpay takes one-time item carts only
+  and offers no 3DS authentication, stored credentials, or card setup; the
+  billing API keeps subscription carts on another card gateway. No
+  client-visible authentication continuation exists for Worldpay.
+
+Auto, Confirm, and pre-tokenized sessions charge a stored payment method, which
+the Worldpay route does not accept; the billing API keeps those on the released
+Stripe and PayPal routing by itself. Do not add gateway selection, capability
+headers, or provider-specific branches to a create request, whether through
+this SDK or a request you build yourself: the billing API owns that decision,
+and a client-side copy of it would become a second routing authority that
+drifts from the merchant's real gateway state.
+
 ## API Reference
 
 ## Privacy-safe operational telemetry
@@ -437,7 +471,8 @@ payment-success outcomes.
 ```ts
 // 1. Obtain the vault capture block — use an embedded block when supplied, or
 //    fetch it through the explicit recovery route for a session whose Stripe
-//    enabledPaymentMethods explicitly includes `card`. The first
+//    enabledPaymentMethods explicitly includes `card`, or that advertises a
+//    server-side card gateway (`gateways.worldpayCorporateGateway`). The first
 //    argument is the checkout session id (`getVaultCapture(checkoutSessionId, nonce?)`):
 const vault = session.vault ??
   await new PaymentAPI(billingApiUrl).getVaultCapture(checkoutSessionId, nonce);
@@ -468,6 +503,14 @@ capture.on('error', (e) => onError(e.message));
 await capture.mount(container, { html, messageToken, expectedOrigin });
 ```
 
+`e.intentId` is the processing gateway's own reference for the attempt. It is a
+Stripe PaymentIntent (or SetupIntent) id only when Stripe took the card; when
+the session advertises a server-side card gateway such as
+`gateways.worldpayCorporateGateway`, it may be an opaque processor order
+reference instead. Reconcile by `paymentId` and the session rather than
+treating it as a Stripe object. `FloPayCheckout` and `SplitCardForm` omit
+`paymentIntentId` from `onComplete` for those sessions.
+
 `capture.applyTheme(theme)` re-skins the mounted widget without remounting it.
 Pass the `VaultCardThemeColors` the React components compute: the flat keys
 every hosted asset understands plus the optional `submitButton` snapshot
@@ -522,7 +565,9 @@ supplied), or that arrive from a non-matching `expectedOrigin` (when set).
 
 > Backend contract: TeamFloPay/backend#823. Starting with SDK 1.4.9, an explicit
 > `card` entry in `gateways.stripe.enabledPaymentMethods` advertises that hosted
-> capture can be recovered without an embedded `vault` block.
+> capture can be recovered without an embedded `vault` block. A
+> `gateways.worldpayCorporateGateway` entry on an open session advertises the
+> same (TeamFloPay/backend#1563).
 > `PaymentAPI.getVaultCapture()` coalesces concurrent callers, aborts a stalled
 > attempt after ten seconds, and keeps bounded transient-network retry on the
 > idempotent `POST /v1/checkouts/sessions/{id}/vault/capture` route.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flopay/js",
-  "version": "1.9.14",
+  "version": "1.9.16",
   "type": "module",
   "sideEffects": false,
   "publishConfig": {
@@ -32,7 +32,7 @@
   ],
   "dependencies": {
     "@stripe/stripe-js": "^9.8.0",
-    "@flopay/shared": "1.9.14"
+    "@flopay/shared": "1.9.16"
   },
   "devDependencies": {
     "jsdom": "^29.1.1",