Summary

Adds card number restriction support to Dynamic Checkout, allowing merchants to limit accepted cards by IIN (Issuer Identification Number) and card scheme. When a
restricted card is entered, the pay button is disabled and a localized error message is shown.

Changes

• API types: Added restrict_to_iins and restrict_to_schemes nullable arrays to the Card type
• Card payment method:
  • Added IIN-based restriction via iframe postMessage events (card_iin field)
  • Added scheme-based restriction via the existing schemeChanged event
  • Implemented setCardRestrictionState() to disable the pay button and show/clear the error message
  • Preserved restriction state when cleanErrorMessages() runs so the error isn't prematurely cleared
• Locales: Added "card-not-supported-error-message" translation in EN, ES, FR, PL, PT
• Styles: Added disabled state styling (reduced opacity, not-allowed cursor) for the pay button
• Example: Updated example invoice ID

Impact

• Affects Dynamic Checkout card payment flow only
• No breaking changes — restrict_to_iins and restrict_to_schemes are nullable, so existing integrations without these fields are unaffected
• Users with restricted cards see immediate client-side feedback before attempting submission

Testing Plan

1. Configure an invoice with restrict_to_iins set (e.g., specific BIN prefixes) and verify:
   • Entering a matching IIN disables the pay button and shows the "card not supported" error
   • Entering a non-matching IIN allows normal checkout
   • Clearing the card number re-enables the button
2. Configure an invoice with restrict_to_schemes set (e.g., ["visa"]) and verify:
   • Entering a card of a restricted scheme disables the pay button
   • Entering a card of an allowed scheme works normally
3. Verify the error message displays correctly in all supported locales (EN, ES, FR, PL, PT)
4. Verify that when no restrictions are configured (null or []), checkout behaves as before

Additional Context

• The IIN restriction is checked via postMessage events from the card iframe, while scheme restriction uses the existing schemeChanged listener — two separate code
  paths because the data arrives from different sources
• The cleanErrorMessages() method was updated to preserve the restriction error, preventing it from being cleared on subsequent input events