@agent-cards/sdk 0.24.0 → 0.24.2

package/dist/substitutions.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: d9723a3c2f261d8023b1966fd865481e713eaaa2756ba30fe110e543d68d5704
+// artifact-sha256: f402656dc29200331356e78d920979d00a0768d87ea6c630e17c211455679d4b
 // src/adyen-jwe.js
 var ADYEN_JWE_HEADER = { alg: "RSA-OAEP-256", enc: "A256GCM", version: "1" };
 var BASE64URL = /^[A-Za-z0-9_-]+$/;
@@ -1117,6 +1117,99 @@ var MERCHANT_HOSTED_PROFILES = /* @__PURE__ */ deepFreeze([
             clientKey: "live_P7RRXHAHEVFTLPS3XUD3ML7ZWUEZ6BXN",
             publicKeySha256: "3e0d4366563b714feb233d12ce98adcef3b606381596e097ca3a8123b9a91d67"
         }
+    },
+    {
+        // Read Nov 3, 2026, from www.lego.com's shipped US checkout (a Next.js app under /checkout, Apollo GraphQL) and a
+        // card-free run on its guest checkout up to the card form (test contact details, no card typed, nothing pressed;
+        // every non-GET to adyen.com aborted). The checkout's cart answer (CheckoutV2State, paymentMethodsV3.primary) names
+        // CREDIT_CARD_ADYEN with environment 'live' and this client key, and the card form is adyen-web 6's secured fields
+        // (securedFields 6.0.0 on checkoutshopper-live.adyen.com). Place order's handler (chunk 487, the CreditCard submit)
+        // copies encryptedCardNumber, encryptedExpiryMonth, encryptedExpiryYear, encryptedSecurityCode, type and holderName
+        // out of adyen-web's state.data.paymentMethod, with no brand, and sends the Apollo mutation AddAdyenPayment with
+        // variables {input: {paymentReference: <the cart's orderNumber>, telephoneNumber, browserInfo, origin, paymentMethod,
+        // returnUrl, storePaymentMethod, tracking}}. Apollo posts {operationName, variables, query} as JSON to the gateway
+        // (www.lego.com/checkout/api/graphql), whose link adds the operation name to the path: every checkout operation in
+        // the run went to /checkout/api/graphql/<operationName>. So the card request is Lego's own server, Adyen's Advanced
+        // flow. A saved card goes as AddAdyenSavedCardPaymentV2, a gift card as AddGiftCardPaymentV2Mutation, each on its
+        // own path. The body names no amount. Public key read from checkoutshopper-live.adyen.com on 2026-11-03 (UTC). Not
+        // yet seen on the wire: the card request itself, which leaves only on Place order.
+        // Enabled on Nov 4, 2026 under D1, so the Vault's bundled copy of this table carries it at the next Vault release. No
+        // company is admitted yet: Agentcard's proof company joins through a flip in backend merchant-profile-orgs.ts after that
+        // release. Felipe's approval of this change is his D1 decision for LEGO, and Karen's its PCI review.
+        // No afterPayment reader yet: nobody has seen what LEGO answers after a placed order, so the charge is not compared with
+        // the approved amount after payment and merchantChargeVerdict has nothing to read (Greptile on this change). The amount
+        // is checked before payment (amountSource below). Until a reviewed afterPayment lands, built from the response the first
+        // live run captures, Agentcard's proof company makes no purchase LEGO's Adyen approves: its runs use a card Adyen declines.
+        id: "lego_checkout_add_adyen_payment",
+        merchant: "LEGO",
+        status: "enabled",
+        origins: [{ checkout: "https://www.lego.com", endpoint: "https://www.lego.com" }],
+        method: "POST",
+        path: "/checkout/api/graphql/AddAdyenPayment",
+        query: {},
+        requires: [
+            { path: ["operationName"], equals: "AddAdyenPayment" },
+            { path: ["variables", "input", "paymentMethod", "type"], equals: "scheme" }
+        ],
+        holder: ["variables", "input", "paymentMethod"],
+        fields: {
+            encryptedCardNumber: "encryptedCardNumber",
+            encryptedExpiryMonth: "encryptedExpiryMonth",
+            encryptedExpiryYear: "encryptedExpiryYear",
+            encryptedSecurityCode: "encryptedSecurityCode"
+        },
+        // The page copies no brand out of adyen-web's state.
+        remove: [],
+        refuse: [
+            { path: ["variables", "input", "storePaymentMethod"], when: "true" },
+            { path: ["variables", "input", "paymentMethod", "storedPaymentMethodId"], when: "present" },
+            { path: ["variables", "input", "paymentMethod", "recurringDetailReference"], when: "present" }
+        ],
+        amount: null,
+        // Read Nov 3, 2026 (the run above). The checkout's cart answers carry the whole cart: CheckoutV2State at
+        // data.me.cart, the address step at data.updateCartAddresses and the shipping step at data.setCartShippingMethod.
+        // remainingTotalToPay is what is left for the card, in cents (1191 in the run, the page's Order Total $11.91), and
+        // orderNumber is the paymentReference the card request sends, which ties each answer to it. A gift card already
+        // applied shows in payments and lowers what is left below the order's total, so a cart with one is refused. Cart
+        // changes whose answers were not seen in the run make the chosen answer stale.
+        amountSource: {
+            id: "lego_cart_remaining_total",
+            origin: "endpoint",
+            format: "json",
+            responses: [
+                { method: "POST", path: "/checkout/api/graphql/CheckoutV2State", query: {}, at: ["data", "me", "cart"] },
+                { method: "POST", path: "/checkout/api/graphql/SetAddressMutation", query: {}, at: ["data", "updateCartAddresses"] },
+                { method: "POST", path: "/checkout/api/graphql/SetShippingMethodV2Mutation", query: {}, at: ["data", "setCartShippingMethod"] }
+            ],
+            total: { path: ["remainingTotalToPay", "centAmount"], format: "number" },
+            unit: "minor",
+            currency: "USD",
+            currencyPath: ["remainingTotalToPay", "currencyCode"],
+            bind: [{ source: ["orderNumber"], card: ["variables", "input", "paymentReference"] }],
+            refuse: [
+                { path: ["payments"], when: "nonEmpty" },
+                // A GraphQL error result is not a total, even beside partial data.
+                { path: ["errors"], when: "present", root: true }
+            ],
+            voidedBy: [
+                { method: "POST", path: "/checkout/api/graphql/AddGiftCardPaymentV2Mutation", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/AddGiftCardOnlyPayment", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/RemoveGiftCardPaymentMutations", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/AddVipLineItemCheckout", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/EditVipLineItemCheckout", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/RemoveVipPointsLineItemCheckout", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/SetShippingMethodOnlyMutation", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/SetAddressMutationWithoutEmail", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/SetAddressesMutationV2", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/saveCollectionPointMutation", query: {} }
+            ],
+            maxAgeMs: 9e5
+        },
+        adyen: {
+            environment: "live",
+            clientKey: "live_P34BZ2Q6ANHNHAUEKOFOX3IMHQHZ75ES",
+            publicKeySha256: "5659f43faa157b82b45844fdf35382a8b83b7bb24662b5e0fbcca15fd120bcc2"
+        }
     }
 ]);
 function adyenKeyHost(environment) {

package/dist/tap-payments.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: d5eb385431ea4768b88da6c9cdd3b17894a13c5247d3ef2e16b3beeda90ed617
+// artifact-sha256: d5ba000080ddbaa60195e0755732280bb41d62120f820d0194b904dc510ebe4d
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,
@@ -146,6 +146,7 @@ var BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
 var SHA256_HEX = /^[0-9a-f]{64}$/;
 var RSA_ALGORITHM = [48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0];
 var MODULUS_BYTES = [128, 256, 384, 512];
+var SMALL_MODULUS_BYTES = 64;
 var MIN_PADDING = 8;
 var MAX_DRAWS = 16;
 var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
@@ -156,6 +157,9 @@ function parseRsaPublicKey(key) {
     const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
     if (named !== void 0 && named !== 17)
         throw refuse("key");
+    const sized = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "bits") ? key.bits : void 0;
+    if (sized !== void 0 && sized !== 512)
+        throw refuse("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse("key");
     if (typeof pin !== "string" || !SHA256_HEX.test(pin))
@@ -188,7 +192,8 @@ function parseRsaPublicKey(key) {
     if (exponent.end !== rsa.end)
         throw refuse("key");
     const n = modulus.bytes;
-    if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
+    const sizes = sized === 512 ? [SMALL_MODULUS_BYTES] : MODULUS_BYTES;
+    if (!sizes.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
         throw refuse("key");
     const e = exponent.bytes;
     const expected = named === 17 ? [17] : [1, 0, 1];

package/dist/token-repeats.d.ts

@@ -0,0 +1,32 @@
+import type { ReplayResponse } from './client.js';
+/** How long an approved answer may answer a re-send: the approval's own lifetime (cdp.ts HOSTED_FORM_REPEAT_QUIET_MS). */
+export declare const TOKEN_REPEAT_WINDOW_MS: number;
+/** How many re-sends one approved answer answers. Shopify's frame sent 11 in a row; past this the re-send is held. */
+export declare const MAX_TOKEN_REPEATS = 3;
+export interface TokenRepeatAnswer {
+    authorizationId: string;
+    response: {
+        status: number;
+        headers: Record<string, string>;
+        body: string;
+    };
+}
+export declare class TokenRepeats {
+    private readonly now;
+    private last;
+    constructor(now?: () => number);
+    /**
+     * Keep the answer a token replay handed to a card request, once it reached the page. Only a plain token answer the
+     * processor accepted (a 2xx): a hosted form, a card endpoint, a client-side encryption or a device's own send is
+     * never answered again from here. A new answer replaces the last, so an earlier approval answers nothing.
+     */
+    remember(frame: unknown, url: string, body: string | null, replay: ReplayResponse): void;
+    /**
+     * The stored answer for a byte-identical re-send from the same frame under `authorizationId`, inside the window and
+     * the count, or null. Handing one out reserves a place in the count; the caller gives it back (released) when the
+     * answer never reached the page.
+     */
+    answerFor(frame: unknown, url: string, body: string | null, authorizationId: string | null): TokenRepeatAnswer | null;
+    /** Give back a place answerFor reserved for an answer that never reached the page. */
+    released(authorizationId: string): void;
+}

package/dist/token-repeats.js

@@ -0,0 +1,64 @@
+// The page's own re-send of a card request this attachment already answered with an approved token.
+//
+// Once the cardholder's device replayed the card and the processor's token reached the page, a checkout can send the
+// very same card request again before the merchant confirms the order: Shopify's card frame did, after a checkout that
+// sat a few minutes between its total and Pay (lexmod.com, expedusa.com and four more stores, 2026-10-27 to 2026-11-05).
+// The SDK held every such re-send while the merchant resolver read the order as pending (lifecycle.ts resolve), so the
+// page never got a token it would submit and the order stayed unconfirmed with the card already out of the device.
+//
+// TokenRepeats keeps the one answer this attachment last handed a plain token request, and hands it out again only for
+// a byte-identical request from the same frame to the same URL under the same approval: the same card fields, the same
+// amount the approval was given for, and no new question for the cardholder. The pre-claim gate (pre-claim.ts tokenRepeatPreClaim) also
+// asks the merchant resolver first and answers only while the order reads pending, so the stored token never reaches a
+// later purchase. A token the processor takes once is refused by the processor the second time, and nothing charges
+// twice: the page holds the same token it already had, never a second payment.
+/** How long an approved answer may answer a re-send: the approval's own lifetime (cdp.ts HOSTED_FORM_REPEAT_QUIET_MS). */
+export const TOKEN_REPEAT_WINDOW_MS = 15 * 60_000;
+/** How many re-sends one approved answer answers. Shopify's frame sent 11 in a row; past this the re-send is held. */
+export const MAX_TOKEN_REPEATS = 3;
+export class TokenRepeats {
+    now;
+    last = null;
+    constructor(now = Date.now) {
+        this.now = now;
+    }
+    /**
+     * Keep the answer a token replay handed to a card request, once it reached the page. Only a plain token answer the
+     * processor accepted (a 2xx): a hosted form, a card endpoint, a client-side encryption or a device's own send is
+     * never answered again from here. A new answer replaces the last, so an earlier approval answers nothing.
+     */
+    remember(frame, url, body, replay) {
+        try {
+            if (frame === undefined || frame === null || frame === '' || body === null || (replay.mode !== undefined && replay.mode !== 'token'))
+                return;
+            const { status, headers } = replay;
+            if (!(status >= 200 && status < 300) || typeof replay.body !== 'string')
+                return;
+            this.last = { frame, url, body, authorizationId: replay.authorizationId, response: { status, headers: { ...headers }, body: replay.body }, at: this.now(), answered: 0 };
+        }
+        catch {
+            this.last = null;
+        }
+    }
+    /**
+     * The stored answer for a byte-identical re-send from the same frame under `authorizationId`, inside the window and
+     * the count, or null. Handing one out reserves a place in the count; the caller gives it back (released) when the
+     * answer never reached the page.
+     */
+    answerFor(frame, url, body, authorizationId) {
+        const last = this.last;
+        if (!last || !authorizationId || body === null || frame === undefined || frame === null || frame === '')
+            return null;
+        if (last.authorizationId !== authorizationId || last.frame !== frame || last.url !== url || last.body !== body)
+            return null;
+        if (this.now() - last.at >= TOKEN_REPEAT_WINDOW_MS || last.answered >= MAX_TOKEN_REPEATS)
+            return null;
+        last.answered += 1;
+        return { authorizationId, response: { ...last.response, headers: { ...last.response.headers } } };
+    }
+    /** Give back a place answerFor reserved for an answer that never reached the page. */
+    released(authorizationId) {
+        if (this.last?.authorizationId === authorizationId && this.last.answered > 0)
+            this.last.answered -= 1;
+    }
+}

package/dist/twoc2p.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: c49f275728b59d60213cd4db98c8c96bb9fe3355a2a4f3688e39ce98205afddd
+// artifact-sha256: 9dd7f5576d8ac7125656bcf968be5604bf34bcabd516013e51a4768b5d84e791
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,
@@ -146,6 +146,7 @@ var BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
 var SHA256_HEX = /^[0-9a-f]{64}$/;
 var RSA_ALGORITHM = [48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0];
 var MODULUS_BYTES = [128, 256, 384, 512];
+var SMALL_MODULUS_BYTES = 64;
 var MIN_PADDING = 8;
 var MAX_DRAWS = 16;
 var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
@@ -156,6 +157,9 @@ function parseRsaPublicKey(key) {
     const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
     if (named !== void 0 && named !== 17)
         throw refuse("key");
+    const sized = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "bits") ? key.bits : void 0;
+    if (sized !== void 0 && sized !== 512)
+        throw refuse("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse("key");
     if (typeof pin !== "string" || !SHA256_HEX.test(pin))
@@ -188,7 +192,8 @@ function parseRsaPublicKey(key) {
     if (exponent.end !== rsa.end)
         throw refuse("key");
     const n = modulus.bytes;
-    if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
+    const sizes = sized === 512 ? [SMALL_MODULUS_BYTES] : MODULUS_BYTES;
+    if (!sizes.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
         throw refuse("key");
     const e = exponent.bytes;
     const expected = named === 17 ? [17] : [1, 0, 1];

package/examples/preflight/kernel-native/inventory.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "catalog_version": "2026-09-15.1",
-  "catalog_sha256": "d27bf03744adafed6b1e6731f61439bb410e90ab4937dcb279d3e5db46784784",
+  "catalog_sha256": "87d4e75b981d7186a2cd39b6f382717acf5b757d053ed389cb8e181f261f0a49",
   "baseline_version": "kernel-native-docs-2026-09-11.1",
   "baseline_sha256": "d86722f49633d8223fccae54cd3d485df4375aee06aa156a273cc689b7c8507c",
   "native_build": null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.24.0",
+  "version": "0.24.2",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; buy asks the Purchase API for a cart and places it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",
@@ -30,7 +30,7 @@
     "_comment_test": "check:built runs first and names the command when a file the build generates (the copies in src/, the preflight contracts in dist/, the Kernel inventory) is missing or stale; verify:pack runs last, on the same dist.",
     "check:built": "node scripts/generate-payment-core.mjs --check && node scripts/generate-url-masks.mjs --check && node scripts/generate-capabilities.mjs --check && node scripts/generate-agent-amount.mjs --check && node scripts/generate-preflight-contract.mjs --check && node scripts/generate-kernel-native-inventory.mjs --check",
     "verify:pack": "node scripts/verify-pack.mjs",
-    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paytrail.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs payrexx.test.mjs payrexx-follow-ups.test.mjs payrexx-adapters.test.mjs nike-order.test.mjs nike-order-adapters.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs openpay.test.mjs processout.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs agentcard.test.mjs buy.test.mjs clean-dist.test.mjs approvals.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs sbps.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs gopay.test.mjs paygent.test.mjs twoc2p.test.mjs tap-payments.test.mjs pay-nl.test.mjs toast.test.mjs redact-url.test.mjs hosted-entry.test.mjs comgate.test.mjs przelewy24.test.mjs tokenex-iframe.test.mjs transbank.test.mjs sumup.test.mjs clover.test.mjs eximbay.test.mjs xendit.test.mjs omise.test.mjs fastspring.test.mjs amazon-payment-services.test.mjs barion.test.mjs paymob.test.mjs payu-latam.test.mjs nexi-checkout.test.mjs oceanpayment.test.mjs pin-payments.test.mjs payplug.test.mjs paymentwall.test.mjs vtex-payments.test.mjs vtex-payments-window.test.mjs iyzico.test.mjs usaepay.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs browser-tests.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
+    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paytrail.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs payrexx.test.mjs payrexx-follow-ups.test.mjs payrexx-adapters.test.mjs nike-order.test.mjs nike-order-adapters.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs openpay.test.mjs processout.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs agentcard.test.mjs buy.test.mjs clean-dist.test.mjs approvals.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs sbps.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs gopay.test.mjs paygent.test.mjs twoc2p.test.mjs tap-payments.test.mjs pay-nl.test.mjs toast.test.mjs redact-url.test.mjs hosted-entry.test.mjs comgate.test.mjs przelewy24.test.mjs tokenex-iframe.test.mjs transbank.test.mjs sumup.test.mjs clover.test.mjs eximbay.test.mjs xendit.test.mjs omise.test.mjs fastspring.test.mjs amazon-payment-services.test.mjs barion.test.mjs paymob.test.mjs payu-latam.test.mjs nexi-checkout.test.mjs oceanpayment.test.mjs pin-payments.test.mjs payplug.test.mjs cardlink-vpos.test.mjs eghl.test.mjs paymentwall.test.mjs vtex-payments.test.mjs vtex-payments-window.test.mjs iyzico.test.mjs usaepay.test.mjs viva-wallet.test.mjs aurus.test.mjs monei.test.mjs paystack.test.mjs frisbii.test.mjs token-repeat.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs browser-tests.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
     "test:browser": "node browser-tests.mjs",
     "check:payment-core": "node scripts/generate-payment-core.mjs --check",
     "test:preflight": "node --test preflight-package.test.mjs preflight-collector.test.mjs kernel-native-qualification.test.mjs",