@agent-cards/sdk 0.23.21 → 0.23.23

package/dist/toast.generated.d.ts

@@ -0,0 +1,41 @@
+declare var TOAST_PSP: string;
+declare var TOAST_CAPABILITY: string;
+declare var TOAST_OPERATION: string;
+declare var TOAST_PAYMENT_METHODS_URL: string;
+declare var TOAST_KEY_ID: string;
+declare var TOAST_KEY: Readonly<{
+    spki: "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkq50dXdz/fQOwYUswZRXgh5Vghs1tcJZCv2goNsC5BO3dXC/EiejcApaE/fKVMespzDNSLsQHXrWHegpE2piyeBwMzpTbHrCG3v6MnG6Nu+9dBYxPS4T9cNMsf0V/iCPiiaTXib6r8IfOjVZTTas2nKGZEtiDfYJIS3bJ/f30SMP4dAFILvzXGALeqleB/psQ8AFc/qUZf7VZpRnoGtKoo8wD253xTmDdaiKqr09bcJZxhTWsCB9aYouqdbl6y9/5Lu+MtyBkj7LI05g5QqDSfVax0sp/Fe7RY5SYxwlR4GlMonwtbvFTMKsr6dZ1uLuNjHA/6dm+112Uqn/AxrKGwIDAQAB";
+    sha256: "5475b78c9577b1258615286307547aba18c52faa6fd7d60ad0cfcb996e21ad0e";
+}>;
+declare var TOAST_CIPHERTEXT_BYTES: number;
+declare var TOAST_SUBSTITUTION: Readonly<{
+    at: "card";
+    fields: readonly string[];
+}>;
+declare var TOAST_REFUSAL_CODES: readonly string[];
+declare function isToastPaymentMethodsUrl(url: any): boolean;
+declare function isToastHost(url: any): boolean;
+declare function isToastCiphertext(value: any): boolean;
+declare function readToastBody(body: any): Readonly<{
+    ok: false;
+    code: any;
+}> | Readonly<{
+    ok: false;
+    wallet: true;
+}> | Readonly<{
+    ok: boolean;
+    sessionSecret: any;
+    postalCode: any;
+    cardData: any;
+}>;
+declare function toastBodyVerdict(body: any): Readonly<{
+    verdict: "card";
+}> | Readonly<{
+    verdict: "continue";
+}> | Readonly<{
+    verdict: "refuse";
+    code: any;
+}>;
+declare function toastRequestRefusal(request: any): any;
+declare function toastRefusalMessage(code: any): any;
+export { TOAST_CAPABILITY, TOAST_CIPHERTEXT_BYTES, TOAST_KEY, TOAST_KEY_ID, TOAST_OPERATION, TOAST_PAYMENT_METHODS_URL, TOAST_PSP, TOAST_REFUSAL_CODES, TOAST_SUBSTITUTION, isToastCiphertext, isToastHost, isToastPaymentMethodsUrl, readToastBody, toastBodyVerdict, toastRefusalMessage, toastRequestRefusal };

package/dist/toast.generated.js

@@ -0,0 +1,113 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: d0c3bda9a5b7939a6984156929cbcb7ba7d427fa38c544aad65c4593cf272d05
+// src/toast.js
+var TOAST_PSP = "toast";
+var TOAST_CAPABILITY = "toast_pinned_key";
+var TOAST_OPERATION = "toast.encrypted_card";
+var TOAST_PAYMENT_METHODS_URL = "https://payments.toasttab.com/v1/payment-methods";
+var TOAST_KEY_ID = "RSA-OAEP-SHA1::bacb4887-8314-4c23-98fc-d5ef7bc99e94_oo-legacy-browsers";
+var TOAST_KEY = /* @__PURE__ */ Object.freeze({
+    spki: "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkq50dXdz/fQOwYUswZRXgh5Vghs1tcJZCv2goNsC5BO3dXC/EiejcApaE/fKVMespzDNSLsQHXrWHegpE2piyeBwMzpTbHrCG3v6MnG6Nu+9dBYxPS4T9cNMsf0V/iCPiiaTXib6r8IfOjVZTTas2nKGZEtiDfYJIS3bJ/f30SMP4dAFILvzXGALeqleB/psQ8AFc/qUZf7VZpRnoGtKoo8wD253xTmDdaiKqr09bcJZxhTWsCB9aYouqdbl6y9/5Lu+MtyBkj7LI05g5QqDSfVax0sp/Fe7RY5SYxwlR4GlMonwtbvFTMKsr6dZ1uLuNjHA/6dm+112Uqn/AxrKGwIDAQAB",
+    sha256: "5475b78c9577b1258615286307547aba18c52faa6fd7d60ad0cfcb996e21ad0e"
+});
+var TOAST_CIPHERTEXT_BYTES = 256;
+var TOAST_SUBSTITUTION = /* @__PURE__ */ Object.freeze({ at: "card", fields: Object.freeze(["cardData"]) });
+var TOAST_REFUSAL_CODES = /* @__PURE__ */ Object.freeze(["toast_url_refused", "toast_foreign_key", "toast_keeps_card", "toast_body_malformed"]);
+var BODY_LIMIT = 8192;
+var ROOT_KEYS = /* @__PURE__ */ Object.freeze(["type", "card", "sessionSecret", "usage", "setupFutureUsage", "billingDetails"]);
+var CARD_KEYS = /* @__PURE__ */ Object.freeze(["keyId", "cardData"]);
+var WALLETS = /* @__PURE__ */ Object.freeze(["APPLE_PAY", "GOOGLE_PAY"]);
+var SESSION_SECRET = /^[\x21-\x7e]{1,1024}$/;
+var POSTAL_CODE = /^[A-Za-z0-9 -]{0,16}$/;
+var CIPHERTEXT_B64 = /^[A-Za-z0-9+/]{341}[AQgw]==$/;
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var sameKeys = (value, keys) => {
+    const own = Object.keys(value);
+    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+};
+var refuse = (code) => Object.freeze({ verdict: "refuse", code });
+var failed = (code) => (
+/** @type {ToastBodyReadJs} */
+Object.freeze({ ok: false, code }));
+var CARD = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+var CONTINUE = /* @__PURE__ */ Object.freeze({ verdict: "continue" });
+function isWalletBody(parsed) {
+    const card = parsed.card;
+    const rootOk = sameKeys(parsed, ["type", "card", "sessionSecret"]) || sameKeys(parsed, ["type", "card", "sessionSecret", "billingDetails"]) && record(parsed.billingDetails);
+    return rootOk && WALLETS.includes(parsed.type) && record(card) && sameKeys(card, ["keyId", "cardData", "wallet"]) && card.keyId === null && typeof card.cardData === "string" && record(card.wallet) && sameKeys(card.wallet, ["type"]) && card.wallet.type === parsed.type && typeof parsed.sessionSecret === "string";
+}
+function isToastPaymentMethodsUrl(url) {
+    return url === TOAST_PAYMENT_METHODS_URL;
+}
+function isToastHost(url) {
+    if (typeof url !== "string")
+        return false;
+    try {
+        return new URL(url).hostname.toLowerCase().replace(/\.$/, "") === "payments.toasttab.com";
+    }
+    catch {
+        return false;
+    }
+}
+function isToastCiphertext(value) {
+    return typeof value === "string" && CIPHERTEXT_B64.test(value);
+}
+function readToastBody(body) {
+    const malformed = failed("toast_body_malformed");
+    if (typeof body !== "string" || body.length > BODY_LIMIT)
+        return malformed;
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return malformed;
+    }
+    if (!record(parsed) || JSON.stringify(parsed) !== body)
+        return malformed;
+    if (isWalletBody(parsed))
+        return (
+        /** @type {ToastBodyReadJs} */
+        Object.freeze({ ok: false, wallet: true }));
+    const card = parsed.card;
+    if (!sameKeys(parsed, ROOT_KEYS) || parsed.type !== "CARD" || !record(card) || !sameKeys(card, CARD_KEYS))
+        return malformed;
+    if (typeof card.keyId !== "string")
+        return malformed;
+    if (card.keyId !== TOAST_KEY_ID)
+        return failed("toast_foreign_key");
+    if (!isToastCiphertext(card.cardData))
+        return malformed;
+    if (typeof parsed.sessionSecret !== "string" || !SESSION_SECRET.test(parsed.sessionSecret))
+        return malformed;
+    if (parsed.usage !== null || parsed.setupFutureUsage !== null)
+        return failed("toast_keeps_card");
+    const billing = parsed.billingDetails;
+    if (!record(billing) || !sameKeys(billing, ["postalCode"]) || typeof billing.postalCode !== "string" || !POSTAL_CODE.test(billing.postalCode))
+        return malformed;
+    const read = { ok: true, sessionSecret: parsed.sessionSecret, postalCode: billing.postalCode, cardData: card.cardData };
+    return Object.freeze(read);
+}
+function toastBodyVerdict(body) {
+    const read = readToastBody(body);
+    if (read.ok)
+        return CARD;
+    return read.wallet ? CONTINUE : refuse(read.code);
+}
+function toastRequestRefusal(request) {
+    if (!record(request) || typeof request.method !== "string" || request.method.toUpperCase() !== "POST" || !isToastPaymentMethodsUrl(request.url))
+        return "toast_url_refused";
+    const read = readToastBody(request.body);
+    return read.ok ? null : read.code ?? "toast_body_malformed";
+}
+var REFUSAL_MESSAGES = /* @__PURE__ */ Object.freeze({
+    toast_url_refused: "Refusing to pay: this Toast card request does not go to the address Toast's card form sends cards to. Nothing was sent.",
+    toast_foreign_key: "Refusing to pay: this Toast card request is encrypted under a key Agentcard has not reviewed. Nothing was sent.",
+    toast_keeps_card: "Refusing to pay: this Toast checkout asks to keep the card for later payments, and Agentcard pays only a one-time guest checkout here. Nothing was sent.",
+    toast_body_malformed: "Refusing to pay: this is not the card request of Toast's card form. Nothing was sent."
+});
+function toastRefusalMessage(code) {
+    return Object.prototype.hasOwnProperty.call(REFUSAL_MESSAGES, code) ? REFUSAL_MESSAGES[code] : REFUSAL_MESSAGES.toast_body_malformed;
+}
+export { TOAST_CAPABILITY, TOAST_CIPHERTEXT_BYTES, TOAST_KEY, TOAST_KEY_ID, TOAST_OPERATION, TOAST_PAYMENT_METHODS_URL, TOAST_PSP, TOAST_REFUSAL_CODES, TOAST_SUBSTITUTION, isToastCiphertext, isToastHost, isToastPaymentMethodsUrl, readToastBody, toastBodyVerdict, toastRefusalMessage, toastRequestRefusal };

package/dist/transbank.d.ts

@@ -43,3 +43,36 @@ export declare function servesTransbank(vault: {
 export declare function isArmedTransbankUrl(vault: {
     isCardRequest(url: string, method?: string): boolean;
 } | undefined, url: string): boolean;
+/**
+ * A reviewed Webpay shop, as this build reads it to send the browser back: the hosts of its checkout pages, the host of
+ * its return page, and the return page itself, exactly as its transactions name it (null while nobody has read it).
+ */
+export interface TransbankReturnPage {
+    readonly hosts: readonly string[];
+    readonly returnHost: string;
+    readonly returnUrl: string | null;
+}
+/**
+ * payment-core's TRANSBANK_MERCHANTS, every row that names its commerce code, with these three fields. A row without a
+ * code names no shop there, so it is not listed here. transbank.test.mjs pins this list to payment-core's, so a reviewed
+ * change that codes a shop there fails this package's tests until the shop is listed here too. Teleférico Santiago's
+ * row names no code yet, so no paused entry is sent back anywhere.
+ */
+export declare const TRANSBANK_RETURN_PAGES: readonly TransbankReturnPage[];
+/**
+ * Where the paused Webpay entry `entryUrl` goes once the cardholder's phone has paid it: the return page of the one
+ * reviewed shop whose checkout pages include `pageOrigin` (the origin the create named, written exactly as an origin),
+ * with the entry's token as `token_ws`. The same navigation payment-core's transbankMerchantReturn builds, and the one
+ * Webpay itself sends the phone's session to. Null for a link that is not Webpay's entry, a page no reviewed shop
+ * lists, a page two list, or a shop whose return page no token can follow. `pages` is for tests.
+ */
+export declare function transbankMerchantReturn(entryUrl: unknown, pageOrigin: unknown, pages?: readonly TransbankReturnPage[]): string | null;
+/**
+ * The answer the paused entry gets: a 303 to the shop's return page, which the browser follows with a GET, and which no
+ * cache keeps (the URL carries Webpay's token).
+ */
+export declare function transbankMerchantReturnAnswer(returnUrl: string): {
+    status: 303;
+    headers: Record<string, string>;
+    body: string;
+};

package/dist/transbank.js

@@ -71,3 +71,65 @@ export function servesTransbank(vault) {
 export function isArmedTransbankUrl(vault, url) {
     return isTransbankHost(url) && servesTransbank(vault);
 }
+/**
+ * payment-core's TRANSBANK_MERCHANTS, every row that names its commerce code, with these three fields. A row without a
+ * code names no shop there, so it is not listed here. transbank.test.mjs pins this list to payment-core's, so a reviewed
+ * change that codes a shop there fails this package's tests until the shop is listed here too. Teleférico Santiago's
+ * row names no code yet, so no paused entry is sent back anywhere.
+ */
+export const TRANSBANK_RETURN_PAGES = Object.freeze([]);
+// Webpay's own return fields (payment-core processors/transbank.js RETURN_FIELDS): a return page never carries one.
+const RETURN_FIELDS = new Set(['token_ws', 'TBK_TOKEN', 'TBK_ORDEN_COMPRA', 'TBK_ID_SESION']);
+/** `page.returnUrl` when a token can follow it, as payment-core's pinnedReturnUrl reads a row's; null otherwise. */
+function returnPageUrl(page) {
+    const raw = page?.returnUrl;
+    if (typeof raw !== 'string' || raw.length > 1024)
+        return null;
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== 'https:' || url.hostname !== page.returnHost || url.port || url.username || url.password || url.href !== raw
+        || /#|\?$|\?&|&&|&$/.test(raw))
+        return null;
+    for (const [name] of url.searchParams)
+        if (RETURN_FIELDS.has(name))
+            return null;
+    return raw;
+}
+/**
+ * Where the paused Webpay entry `entryUrl` goes once the cardholder's phone has paid it: the return page of the one
+ * reviewed shop whose checkout pages include `pageOrigin` (the origin the create named, written exactly as an origin),
+ * with the entry's token as `token_ws`. The same navigation payment-core's transbankMerchantReturn builds, and the one
+ * Webpay itself sends the phone's session to. Null for a link that is not Webpay's entry, a page no reviewed shop
+ * lists, a page two list, or a shop whose return page no token can follow. `pages` is for tests.
+ */
+export function transbankMerchantReturn(entryUrl, pageOrigin, pages = TRANSBANK_RETURN_PAGES) {
+    if (!isTransbankEntryUrl(entryUrl) || typeof pageOrigin !== 'string' || pageOrigin.length > 256)
+        return null;
+    const token = new URL(entryUrl).searchParams.get('token_ws');
+    let origin;
+    try {
+        origin = new URL(pageOrigin);
+    }
+    catch {
+        return null;
+    }
+    if (origin.protocol !== 'https:' || origin.origin !== pageOrigin || origin.port)
+        return null;
+    const listing = pages.filter((page) => Array.isArray(page?.hosts) && page.hosts.includes(origin.hostname));
+    const returnUrl = listing.length === 1 ? returnPageUrl(listing[0]) : null;
+    if (!returnUrl || !token)
+        return null;
+    return `${returnUrl}${new URL(returnUrl).search ? '&' : '?'}token_ws=${token}`;
+}
+/**
+ * The answer the paused entry gets: a 303 to the shop's return page, which the browser follows with a GET, and which no
+ * cache keeps (the URL carries Webpay's token).
+ */
+export function transbankMerchantReturnAnswer(returnUrl) {
+    return { status: 303, headers: { location: returnUrl, 'cache-control': 'no-store' }, body: '' };
+}

package/dist/url-mask-parts.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The parts every URL mask is built from (client.ts redactUrl). A processor whose card request carries its own
+ * credential in the URL path writes its mask in src/url-masks/<psp id>.ts, exported as `mask`, and the build
+ * collects every such file into src/url-masks.generated.ts (scripts/generate-url-masks.mjs).
+ */
+/**
+ * `mask` reads a text that names the processor's host; `pathMask`, where a processor has one, reads the path of a
+ * URL already parsed on that host, which `mask` reads otherwise.
+ */
+export interface UrlMask {
+    host: RegExp;
+    named: RegExp;
+    mask: (path: string) => string;
+    pathMask?: (path: string) => string;
+}
+/**
+ * A slash as the masks read one: plain, or escaped once or more in either case (%2F, %2f, %252F). A path keeps
+ * an escape as it was written, and the id behind it is the same id, so every slash a mask names reads in any of these
+ * spellings. The slashes right before an id read as a run, and a doubled slash hides nothing either.
+ */
+export declare const SLASH = "(?:/|%(?:25)*2f)";
+/** A hyphen inside an id: plain, or escaped once or more in either case (%2D, %252d). */
+export declare const HYPHEN = "(?:-|%(?:25)*2d)";
+export declare function maskUuids(path: string, label: string): string;

package/dist/url-mask-parts.js

@@ -0,0 +1,22 @@
+/**
+ * The parts every URL mask is built from (client.ts redactUrl). A processor whose card request carries its own
+ * credential in the URL path writes its mask in src/url-masks/<psp id>.ts, exported as `mask`, and the build
+ * collects every such file into src/url-masks.generated.ts (scripts/generate-url-masks.mjs).
+ */
+/**
+ * A slash as the masks read one: plain, or escaped once or more in either case (%2F, %2f, %252F). A path keeps
+ * an escape as it was written, and the id behind it is the same id, so every slash a mask names reads in any of these
+ * spellings. The slashes right before an id read as a run, and a doubled slash hides nothing either.
+ */
+export const SLASH = '(?:/|%(?:25)*2f)';
+/** A hyphen inside an id: plain, or escaped once or more in either case (%2D, %252d). */
+export const HYPHEN = '(?:-|%(?:25)*2d)';
+/**
+ * The masks that find a uuid by its shape take it in any case, with or without its hyphens, each hyphen in any
+ * spelling HYPHEN reads. The pattern reads a percent escape as one unit and keeps it, so the hex digits of an escaped
+ * separator before the id (%2F, %252F, %3D) never start a match and leave the id's last digits showing.
+ */
+const UUID_OR_ESCAPE = new RegExp(`%(?:25)*[0-9a-f]{2}|[0-9a-f]{8}${HYPHEN}?[0-9a-f]{4}${HYPHEN}?[0-9a-f]{4}${HYPHEN}?[0-9a-f]{4}${HYPHEN}?[0-9a-f]{12}`, 'gi');
+export function maskUuids(path, label) {
+    return path.replace(UUID_OR_ESCAPE, (token) => (token.startsWith('%') ? token : label));
+}

package/dist/url-masks.generated.d.ts

@@ -0,0 +1,3 @@
+import type { UrlMask } from './url-mask-parts.js';
+/** The masks of the processors registered in src/url-masks/: none yet. */
+export declare const URL_MASKS: readonly UrlMask[];

package/dist/url-masks.generated.js

@@ -0,0 +1,2 @@
+/** The masks of the processors registered in src/url-masks/: none yet. */
+export const URL_MASKS = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.21",
+  "version": "0.23.23",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",
@@ -25,12 +25,12 @@
   },
   "scripts": {
     "_comment_build": "The public SDK keeps zero runtime dependencies. Its build vendors deterministic metadata and substitution artifacts from the internal payment core (src/*.generated.ts), the voice streaming door from packages/voice/src/core (the phone package, @agent-cards/voice, ships it to phones), and the Kernel kit's inventory from the built catalog; git ignores every file it writes. TypeScript remains pinned.",
-    "build": "node ../payment-core/scripts/build.mjs && node scripts/generate-payment-core.mjs && node scripts/generate-voice-stream.mjs && npx -y -p typescript@5.9.3 tsc && node scripts/generate-preflight-contract.mjs && node scripts/generate-kernel-native-inventory.mjs",
+    "build": "node ../payment-core/scripts/build.mjs && node scripts/generate-payment-core.mjs && node scripts/generate-voice-stream.mjs && node scripts/generate-url-masks.mjs && node scripts/generate-capabilities.mjs && node scripts/generate-agent-amount.mjs && npx -y -p typescript@5.9.3 tsc && node scripts/generate-preflight-contract.mjs && node scripts/generate-kernel-native-inventory.mjs",
     "prepublishOnly": "pnpm build",
     "_comment_test": "check:built runs first and names the command when a file the build generates (the copies in src/, the preflight contracts in dist/, the Kernel inventory) is missing or stale; verify:pack runs last, on the same dist.",
-    "check:built": "node scripts/generate-payment-core.mjs --check && node scripts/generate-voice-stream.mjs --check && node scripts/generate-preflight-contract.mjs --check && node scripts/generate-kernel-native-inventory.mjs --check",
+    "check:built": "node scripts/generate-payment-core.mjs --check && node scripts/generate-voice-stream.mjs --check && node scripts/generate-url-masks.mjs --check && node scripts/generate-capabilities.mjs --check && node scripts/generate-agent-amount.mjs --check && node scripts/generate-preflight-contract.mjs --check && node scripts/generate-kernel-native-inventory.mjs --check",
     "verify:pack": "node scripts/verify-pack.mjs",
-    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs gopay.test.mjs twoc2p.test.mjs pay-nl.test.mjs redact-url.test.mjs hosted-entry.test.mjs comgate.test.mjs przelewy24.test.mjs tokenex-iframe.test.mjs transbank.test.mjs sumup.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs browser-tests.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
+    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paytrail.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs payrexx.test.mjs payrexx-follow-ups.test.mjs payrexx-adapters.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs sbps.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs gopay.test.mjs paygent.test.mjs twoc2p.test.mjs pay-nl.test.mjs toast.test.mjs redact-url.test.mjs hosted-entry.test.mjs comgate.test.mjs przelewy24.test.mjs tokenex-iframe.test.mjs transbank.test.mjs sumup.test.mjs clover.test.mjs eximbay.test.mjs xendit.test.mjs omise.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs browser-tests.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
     "test:browser": "node browser-tests.mjs",
     "check:payment-core": "node scripts/generate-payment-core.mjs --check",
     "check:voice-stream": "node scripts/generate-voice-stream.mjs --check",