chore(POCP-1226): support 8-digit IINs in card event

[lukasz-k-bieszczad-cko]

Description

The PO.JS card event exposes a card's IIN capped at 6 digits (card_iin). Civitatis needs 8 digits to call MercadoPago's GET /installments directly. Rather than widening the existing field (a breaking change for merchants
expecting 6 digits), this adds a new 8-digit field alongside the untouched 6-digit one, letting merchants migrate at their own pace.

Solution

• New Card.getIIN8: returns 8 digits only when the PAN is exactly 16 digits and the scheme is in the allow-list; Amex, non-16-digit PANs, unknown or co-badged/ambiguous prefixes fall back to 6 (never empty, so merchants need no empty-value fallback).
• Card.getIIN unchanged (still capped at 6). The legacy card_iin event field keeps its exact current behaviour -legacy merchants are unaffected.
• New card_iin8 event field can be emitted from the card form's getFieldData() alongside card_iin.
• Dynamic Checkout IIN restriction (restrict_to_iins) now matches on card_iin8 when present, falling back to card_iin, using prefix match so 6- or 8-digit allowlist entries both work.
• getCardInformation still passes up to 8 digits to the iins/{iin} lookup. Minimum-length guard (6) unchanged.

Notes

• Requires the paired checkout-cdn PR to emit card_iin8.

Checklist

• I bumped the version of the project using yarn bump-version
• I have checked the code for any potential issues
• I tested my changes in the browser

Jira Issue

POCP-1226

[Copilot]

Pull request overview

This PR updates the SDK’s card IIN handling to support up to 8-digit IINs, enabling more accurate issuer lookups (notably for MercadoPago installments) while preserving compatibility with existing 6-digit behavior.

Changes:

• Increase IIN extraction cap from 6 → 8 digits in Card.getIIN.
• Update ProcessOut.getCardInformation to use up to 8 digits for the iins/{iin} lookup (minimum length remains 6).
• Adjust Dynamic Checkout restrict_to_iins matching from exact equality to prefix-based matching.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/processout/processout.ts	Expands IIN lookup in getCardInformation from 6 to 8 digits.
src/processout/card.ts	Raises Card.getIIN maximum returned length from 6 to 8 digits.
src/dynamic-checkout/payment-methods/card.ts	Changes restrict_to_iins allowlist evaluation to use prefix matching.
package.json	Bumps package version to 1.9.8.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[lukasz-k-bieszczad-cko]

Tests

ProcessOut.Card.getIIN("4242424242424242")
'42424242'

po.getCardInformation("42424242", console.log, console.error)
{
    "card_information": {
        "bank_name": "STRIPE PAYMENTS UK LIMITED",
        "brand": "visa classic",
        "category": "consumer",
        "co_scheme": null,
        "combo_card_types": null,
        "country": "GB",
        "scheme": "visa",
        "type": "credit"
    },
    "success": true
}

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/processout/card.ts:516

• canExpose8DigitIIN() uses Card.getPossibleSchemes(number) and requires all matches to be allow-listed. Because getPossibleSchemes() includes very broad prefixes (e.g. maestro matches any PAN starting with "6" via the "6" option), 16-digit PANs for Discover/UnionPay will always include maestro in the match set, making canExpose8DigitIIN() return false even though "discover"/"union-pay" are in iin8DigitSchemes. This makes 8-digit IIN exposure effectively unreachable for those schemes.

            var schemes = Card.getPossibleSchemes(number);
            if (schemes.length == 0)
                return false;

            for (var i = 0; i < schemes.length; i++) {
                if (Card.iin8DigitSchemes.indexOf(schemes[i]) === -1)
                    return false;
            }

examples/card-form/index.html:60

• The example now calls getCardInformation(e.card_iin8, ...) unconditionally when card_number_length == 8. If card_iin8 isn’t present (e.g., older embedded card form / checkout-cdn), this will always hit the error callback with card.invalid-number. Adding a fallback to card_iin keeps the example compatible while still preferring the 8-digit field when available.

              if (e.card_number_length == 8) {
                client.getCardInformation(
                  e.card_iin8,

[lukasz-k-bieszczad-cko]

Open question on the name of the new field:
Currently it's card_iin8 but could be something like card_iin_v2 to make it more generic. WDYT?

[roshan-gorasia-cko]

Open question on the name of the new field: Currently it's card_iin8 but could be something like card_iin_v2 to make it more generic. WDYT?

Thinking out loud, are there any "settings" merchants can apply to this? e.g. we have a setting for enabling this functionality on the existing field

TBD if this is a good idea as the less the merchant has to do the better - and at some point the eight will become the norm

[lukasz-k-bieszczad-cko]

Open question on the name of the new field: Currently it's card_iin8 but could be something like card_iin_v2 to make it more generic. WDYT?

Thinking out loud, are there any "settings" merchants can apply to this? e.g. we have a setting for enabling this functionality on the existing field

TBD if this is a good idea as the less the merchant has to do the better - and at some point the eight will become the norm

We could use CardFieldOptions (passed to setupForm) maybe.
That would be something like this:

const client = new ProcessOut.ProcessOut(projectId)
const formElement = document.getElementById("card-form")

client.setupForm(
  formElement,
  {
    (...)
    exposeIIN8: true, 
  },
  function (form) {
    form.getNumberField().on("input", function (e) {
        e.card_iin <---- returns 6 or 8 digits depending on exposeIIN8
        (...)
  },
  function (err) { console.error(err) }
)

The weird thing might be that even though merchant enables that in po.js we won't return 8-digits if the FF is not enabled.

POC: #279