[sohrabpiq]

Summary

Debranding for the card-entry SDK, part of the client debranding epic (PIQ-5868). It removes every clear company name from the published package and changes one behaviour: origin validation now trusts only the origin of the configured hostedfieldsurl.

Merging publishes 1.3.3 to npm (build_and_publish.yaml runs npm publish on every push to master).

Jira: https://paymentiq.atlassian.net/browse/PIQ-5878

Changes

• src/sdk/api/index.js: validateOrigin drops the two built-in fallback origins (test-hostedpages.paymentiq.io and card-fields.paymentiq.io). setup() already adds the origin of hostedfieldsurl to the allowed list, and the SDK loads the iframes from that same URL and posts to that origin. So the fallbacks could only matter for an integration whose iframes load from a different host than hostedfieldsurl, and that integration would never receive setupContent anyway.
• package.json: removes author, repository, bugs, homepage and the Bambora/Devcode keywords, following the PIQ-5871 precedent in the bootstrapper. Adds "files": ["dist", "index.d.ts"], so CHANGES.md (with its GitHub links), .github/ and .nvmrc no longer ship. Version bumped to 1.3.3, in package-lock.json too.
• README.md: the example URLs become https://<hosted-fields-host>/<version>/index.html, with "your account manager provides the host". The migration notices, the stale version list and the "Notes" section are removed. It adds one sentence telling integrators that messages are accepted only from the origin of hostedfieldsurl, because the changelog no longer ships and the npm page is the only place they will see this. The released versions now live in the Docs Portal guide.
• CHANGES.md: 1.3.3 entry, including the behaviour change.
• dist/: rebuilt with npm run build on Node 20.12.2. On clean master the same build reproduces the committed dist/ byte for byte, so the only dist/ change is validateOrigin.

The npm maintainer stays devcodepayment: that is an npm account setting, and a neutral npm organisation is PIQ-5870. A build-time brand guard for this repo is left to PIQ-5877.

Verification

• Package contents: npm pack of 1.3.3 ships 11 files (README, package.json, index.d.ts, dist). A case-insensitive search of all of them finds no paymentiq, worldline, devcode or bambora. The same search on 1.3.2 fails.
• Browser check:
  • The packed tarball was installed into a local Cashier-React (not committed) and run against the test environment on the test sandbox merchant, with a public test card.
  • A card deposit reached /creditcard/deposit/validate with the iframe's field data, which shows the SDK accepted the iframe's message.
  • The backend answered "account blocked". An identical control run on 1.3.2 gave the same answer, so that comes from the merchant's state.
• Not verified: Click to Pay, which the sandbox merchant does not offer. It gets checked on the Cashier-React branch preview in the follow-up PR.
• Who is affected: Cashier-React's lockfile stays on 1.3.2 until the follow-up PR, and the Vue cashier pins 1.3.1 exactly, so neither changes when this merges.

Linked PRs and merge order

PIQ-5878 spans four repos. Merge in this order:

1. PaymentIQ-Documentation-Portal: https://github.com/devcode-git/PaymentIQ-Documentation-Portal/pull/3635. Adds the released Hosted Fields versions to the Hosted Card Fields guide. It has to land first, because the SDK README no longer lists versions and the Hosted-Fields checklist step points at this guide.
2. hosted-fields-sdk: PIQ-5878: Remove fallback origins and company names, release 1.3.3 #47. Merging publishes 1.3.3 to npm.
3. PaymentIQ-Hosted-Fields: https://github.com/devcode-git/PaymentIQ-Hosted-Fields/pull/348. One README checklist line. It can merge with or after the SDK, once the Docs Portal PR is in.
4. PaymentIQ-Cashier-React: a follow-up PR once 1.3.3 is on npm. It moves the dependency to ^1.3.3 and removes the PIQ-5878 allowance from the brand-bundle guard, which is what stops the two hosts shipping in V3 builds.

🤖 Generated with Claude Code