fix: sync PaymentMethodsType enum with Flow API spec

[armando-rodriguez-cko]

Summary

• Adds 26 payment methods that were missing from PaymentMethodsType (alipay_cn, alipay_hk, alma, benefit, bizum, dana, gcash, kakaopay, klarna, mbway, mobilepay, octopus, paynow, plaid, qpay, remember_me, sepa, stcpay, stored_card, tabby, tamara, tng, truemoney, twint, vipps, wechatpay), keeping the enum in sync with the Flow API's enabled_payment_methods / disabled_payment_methods values.
• Marks giropay and sofort as deprecated since they are no longer part of the specification, without removing them (backward compatibility).

Related to checkout/checkout-sdk-php#338 (same enum drift found on the PHP SDK)

Test plan

• No existing specs reference PaymentMethodsType, no test changes needed
• RuboCop pre-commit hook passed clean

[agent-wall-e]

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

• security_sensitive_path:lib/checkout_sdk/payments/sessions/payment_methods_type.rb

Operational gates

• ✅ jira_ticket
• ✅ independent_review

Files analysed: 1

---

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
security_sensitive_path — lib/checkout_sdk/payments/sessions/payment_methods_type.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[agent-wall-e]

🔵 Advisory review: Sound, but needs your judgement

This PR needs a human approval. The code itself reads as correct; whether it should land depends on context I don't have.

Adds 26 new payment method constants and deprecates giropay/sofort to sync the enum with the Flow API spec; the change looks mechanically correct but the REMEMBER_ME constant has unusual handling that warrants explicit sign-off.

For you to decide

• The REMEMBER_ME = 'remember_me' constant is described as 'deliberately unlisted in the public specification' to prevent merchants from disabling it en masse — exposing it in the SDK but not the spec is an intentional policy decision that the reviewer should confirm is sanctioned by the product/API team.
• The deprecation comments on GIROPAY and SOFORT are purely documentary; there is no runtime warning (e.g. Ruby warn) emitted when they are used, which may be acceptable for a constants-only module but is worth confirming against the project's deprecation policy.
• No tests reference PaymentMethodsType per the PR description, so there is nothing to verify coverage-wise, but a reviewer should confirm whether adding a simple values-presence test is expected by project convention.
• The string values (e.g. 'alipay_cn', 'klarna', 'wechatpay') should be verified against the live Flow API spec to ensure no typos were introduced; the diff itself cannot be cross-checked without the spec.

---

_{This is not an approval. wall-e cannot auto-approve this PR — it is an opinion to help whoever does. Advisory review · us.anthropic.claude-sonnet-4-6 · wall-e 2026.06.19-02}

[agent-wall-e]

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

• security_sensitive_path:lib/checkout_sdk/payments/sessions/payment_methods_type.rb

Operational gates

• ✅ jira_ticket
• ✅ independent_review

Files analysed: 1

---

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
security_sensitive_path — lib/checkout_sdk/payments/sessions/payment_methods_type.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud