commerce: drop tokenizeCard — the client never sees a PAN

@hanzo/commerce shipped `tokenizeCard({ number, expiryMonth, expiryYear, cvc })`
→ POST /v1/billing/card/tokenize: a typed, documented, published invitation for
any consumer to collect a raw card number in first-party JavaScript. The class
doc demonstrated it with a live-looking PAN and CVC.

Its destination is deleted (commerce, same lane) and it was never reachable
through api.hanzo.ai anyway — no manifest row routes that address. So this
removes a method that could only fail, after putting the consumer's origin in
PCI SAQ-D scope. Card entry is Square Web Payments hosted fields; the nonce they
return is what `addPaymentMethod` already takes.

Co-authored-by: Hanzo Dev <dev@hanzo.ai>

pkgs/commerce/client.ts

@@ -25,15 +25,6 @@
  * })
  * window.location.href = session.checkoutUrl
  *
- * // Tokenize a card (S2S — no external SDK required)
- * const token = await commerce.tokenizeCard({
- *   number: '4242424242424242',
- *   expiryMonth: '12',
- *   expiryYear: '2027',
- *   cvc: '123',
- *   name: 'Jane Smith',
- * })
- *
  * // Subscribe
  * const sub = await commerce.subscribe({ planId: 'pro', userId: 'user_xyz' })
  * ```
@@ -254,28 +245,6 @@ export type CheckoutSessionResponse = {
   }
 }
 
-// ---------------------------------------------------------------------------
-// Card tokenization (S2S — no provider SDK needed on the frontend)
-// ---------------------------------------------------------------------------
-
-export type CardTokenizeRequest = {
-  number: string
-  expiryMonth: string   // "01"–"12"
-  expiryYear: string    // "2025"–"2099"
-  cvc: string
-  name?: string
-  zip?: string
-}
-
-export type CardTokenizeResult = {
-  token: string
-  brand: string
-  last4: string
-  expiryMonth: string
-  expiryYear: string
-  provider: string
-}
-
 // ---------------------------------------------------------------------------
 // Payment method types
 // ---------------------------------------------------------------------------
@@ -560,31 +529,6 @@ export class Commerce {
     })
   }
 
-  // -----------------------------------------------------------------------
-  // Card tokenization (S2S — no external SDK required)
-  // -----------------------------------------------------------------------
-
-  /**
-   * Tokenize a payment card server-side.
-   * No external SDK (Square.js, Stripe.js, etc.) is needed on the frontend.
-   * The card data is sent to the Hanzo Commerce API over HTTPS, which
-   * tokenizes via the configured payment provider (Stripe).
-   */
-  async tokenizeCard(card: CardTokenizeRequest, token?: string): Promise<CardTokenizeResult> {
-    return this.request<CardTokenizeResult>('/v1/billing/card/tokenize', {
-      method: 'POST',
-      body: {
-        number: card.number.replace(/\s/g, ''),
-        expiry_month: card.expiryMonth,
-        expiry_year: card.expiryYear,
-        cvc: card.cvc,
-        name: card.name,
-        zip: card.zip,
-      },
-      token,
-    })
-  }
-
   // -----------------------------------------------------------------------
   // Payment methods
   // -----------------------------------------------------------------------
@@ -593,7 +537,7 @@ export class Commerce {
     params: {
       customerId: string
       type: PaymentMethodType
-      token?: string          // from tokenizeCard
+      token?: string          // provider nonce (Square Web Payments SDK)
       providerRef?: string
       providerType?: string
     },

pkgs/commerce/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanzo/commerce",
-  "version": "7.6.3",
+  "version": "7.6.4",
   "description": "e-commerce framework.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",