@agent-cards/sdk 0.24.1 → 0.25.0

package/dist/stripe-continuation.d.ts

@@ -0,0 +1,45 @@
+/**
+ * How an approved tokenization is named in the confirmation that pays with it,
+ * by the Stripe endpoint whose answer produced it. The same four endpoints mint
+ * an approved object (lifecycle.ts), and this table holds the three a
+ * confirmation names by id on its own. It mirrors APPROVED_OBJECT in the
+ * backend's checkout-continuation.ts, which judges exactly this shape: exactly
+ * one such field, and no payment_method_data field left beside it.
+ *
+ * `/v1/tokens` is deliberately absent. Its field lives inside the method data
+ * (payment_method_data[card][token]), so paying with a card token means writing
+ * into the method data this rewrite strips rather than replacing it, and no page
+ * has been seen doing that. A confirm carrying a card token keeps the ordinary
+ * hold until one is.
+ */
+export declare const STRIPE_APPROVED_WAY: Readonly<Record<string, Readonly<{
+    field: string;
+    prefix: string;
+}>>>;
+/** An approved object a confirmation can pay with: the field that names it, and its id. */
+export type StripeApprovedWay = {
+    field: string;
+    id: string;
+};
+/**
+ * The approved object a Stripe tokenization answer returned, for the endpoint
+ * that answered: its field and its id. Null for an endpoint no confirmation
+ * names by id, for a body that will not parse, and for an id that is not the
+ * one that endpoint mints, so a confirmation can never be sent paying with
+ * something another endpoint produced.
+ */
+export declare function stripeApprovedWay(pathname: string, body: unknown): StripeApprovedWay | null;
+/**
+ * The page's confirmation, paying with `way` instead of the card it carries:
+ * every `payment_method_data[...]` field goes (the card, and the billing details
+ * and telemetry Stripe.js sends beside it; the approved object already carries
+ * the billing details of the approved request), and `<field>=<id>` takes the
+ * place of the first one. Every other field stays byte for byte as the page
+ * wrote it (client_secret, key, expected_payment_method_type, use_stripe_sdk,
+ * return_url, mandate and option fields). Null, and nothing is rewritten, when
+ * the field is not one a confirmation pays with, when the id is not one Stripe
+ * mints, when a key cannot be decoded, when the body already names a way to pay
+ * (payment_method, source, confirmation_token), or when it carries no
+ * payment_method_data at all.
+ */
+export declare function confirmPayingWith(body: string, way: StripeApprovedWay): string | null;

package/dist/stripe-continuation.js

@@ -0,0 +1,106 @@
+// What a Stripe confirmation the cardholder already approved may pay with,
+// shared by the card save and the payment (cdp.ts claimStripeContinuation).
+// Kept in its own module, outside the package's published entries, so its
+// tests can reach it and lifecycle.ts can read the same table.
+//
+// A page tokenizes the card through an approval and then confirms. Some pages
+// confirm with the object they got back, which carries no card. Others send
+// the card again inline, as payment_method_data[card][number] in the confirm:
+// confirmCardSetup with the Card Element after createPaymentMethod does on a
+// SetupIntent, and a store that creates a confirmation token for a fraud check
+// and then calls confirmPayment({ elements }) does on a PaymentIntent. The card
+// in that second request is whatever the agent typed; the approved object holds
+// the cardholder's card. So that confirm is sent paying with the approved
+// object instead, with no card in it, and the API decides whether it is the
+// payment the cardholder approved.
+/**
+ * How an approved tokenization is named in the confirmation that pays with it,
+ * by the Stripe endpoint whose answer produced it. The same four endpoints mint
+ * an approved object (lifecycle.ts), and this table holds the three a
+ * confirmation names by id on its own. It mirrors APPROVED_OBJECT in the
+ * backend's checkout-continuation.ts, which judges exactly this shape: exactly
+ * one such field, and no payment_method_data field left beside it.
+ *
+ * `/v1/tokens` is deliberately absent. Its field lives inside the method data
+ * (payment_method_data[card][token]), so paying with a card token means writing
+ * into the method data this rewrite strips rather than replacing it, and no page
+ * has been seen doing that. A confirm carrying a card token keeps the ordinary
+ * hold until one is.
+ */
+export const STRIPE_APPROVED_WAY = Object.freeze({
+    '/v1/payment_methods': Object.freeze({ field: 'payment_method', prefix: 'pm_' }),
+    '/v1/confirmation_tokens': Object.freeze({ field: 'confirmation_token', prefix: 'ctoken_' }),
+    '/v1/sources': Object.freeze({ field: 'source', prefix: 'src_' }),
+});
+// The other ways a confirmation can say what it pays with. A body that already
+// names one is not the shape rewritten here, the field about to be written
+// included: there is then nothing to replace, and the body already names a way
+// to pay, so the ordinary hold decides it.
+const OTHER_WAYS_TO_PAY = new Set(['payment_method', 'source', 'confirmation_token']);
+// An id as Stripe mints it, and as a form field can carry it unescaped.
+const APPROVED_ID = /^[a-z]+_[A-Za-z0-9]{1,250}$/;
+/**
+ * The approved object a Stripe tokenization answer returned, for the endpoint
+ * that answered: its field and its id. Null for an endpoint no confirmation
+ * names by id, for a body that will not parse, and for an id that is not the
+ * one that endpoint mints, so a confirmation can never be sent paying with
+ * something another endpoint produced.
+ */
+export function stripeApprovedWay(pathname, body) {
+    const way = Object.prototype.hasOwnProperty.call(STRIPE_APPROVED_WAY, pathname) ? STRIPE_APPROVED_WAY[pathname] : undefined;
+    if (!way || typeof body !== 'string')
+        return null;
+    let id;
+    try {
+        id = JSON.parse(body)?.id;
+    }
+    catch {
+        return null;
+    }
+    if (typeof id !== 'string' || !id.startsWith(way.prefix) || !APPROVED_ID.test(id))
+        return null;
+    return { field: way.field, id };
+}
+/**
+ * The page's confirmation, paying with `way` instead of the card it carries:
+ * every `payment_method_data[...]` field goes (the card, and the billing details
+ * and telemetry Stripe.js sends beside it; the approved object already carries
+ * the billing details of the approved request), and `<field>=<id>` takes the
+ * place of the first one. Every other field stays byte for byte as the page
+ * wrote it (client_secret, key, expected_payment_method_type, use_stripe_sdk,
+ * return_url, mandate and option fields). Null, and nothing is rewritten, when
+ * the field is not one a confirmation pays with, when the id is not one Stripe
+ * mints, when a key cannot be decoded, when the body already names a way to pay
+ * (payment_method, source, confirmation_token), or when it carries no
+ * payment_method_data at all.
+ */
+export function confirmPayingWith(body, way) {
+    if (typeof body !== 'string' || body === '')
+        return null;
+    if (!way || !OTHER_WAYS_TO_PAY.has(way.field) || !APPROVED_ID.test(way.id))
+        return null;
+    const kept = [];
+    let replaced = false;
+    for (const chunk of body.split('&')) {
+        if (chunk === '')
+            continue;
+        const eq = chunk.indexOf('=');
+        let key;
+        try {
+            key = decodeURIComponent((eq < 0 ? chunk : chunk.slice(0, eq)).replace(/\+/g, ' '));
+        }
+        catch {
+            return null;
+        }
+        if (OTHER_WAYS_TO_PAY.has(key))
+            return null;
+        if (key.startsWith('payment_method_data[')) {
+            if (!replaced)
+                kept.push(`${way.field}=${way.id}`);
+            replaced = true;
+            continue;
+        }
+        kept.push(chunk);
+    }
+    return replaced ? kept.join('&') : null;
+}

package/dist/stripe-setup.d.ts

@@ -2,15 +2,10 @@
 export declare const STRIPE_SETUP_INTENT_CONFIRM: RegExp;
 /**
  * The page's SetupIntent confirm, paying with `paymentMethod` instead of the
- * card it carries: every `payment_method_data[...]` field goes (the card, and
- * the billing details and telemetry Stripe.js sends beside it; the payment
- * method already carries the billing details of the approved request), and
- * `payment_method=<id>` takes the place of the first one. Every other field
- * stays byte for byte as the page wrote it (client_secret, key,
- * expected_payment_method_type, use_stripe_sdk, return_url, mandate and option
- * fields). Null, and nothing is rewritten, when the id is not a payment
- * method's, when a key cannot be decoded, when the body already names another
- * way to pay (payment_method, source, confirmation_token), or when it carries
- * no payment_method_data at all.
+ * card it carries (confirmPayingWith, with the payment method as the way to
+ * pay). Null, and nothing is rewritten, when the id is not a payment method's,
+ * when a key cannot be decoded, when the body already names another way to pay
+ * (payment_method, source, confirmation_token), or when it carries no
+ * payment_method_data at all.
  */
 export declare function setupConfirmPayingWith(body: string, paymentMethod: string): string | null;

package/dist/stripe-setup.js

@@ -1,6 +1,8 @@
 // The SetupIntent confirm a Stripe card save continues with, shared by both
 // adapters (cdp.ts claimStripeContinuation). Kept in its own module, outside the
-// package's published entries, so its tests can reach it.
+// package's published entries, so its tests can reach it. The rewrite itself,
+// and the table of approved objects a confirmation can pay with, live in
+// stripe-continuation.ts, which the payment side reads too.
 //
 // A page that creates the payment method first (createPaymentMethod, which the
 // cardholder approves) and then confirms a SetupIntent usually pays with the
@@ -12,50 +14,20 @@
 // agent typed; the approved payment method holds the cardholder's card. So that
 // confirm continues paying with the approved payment method instead, once the
 // API allows it.
+import { confirmPayingWith } from './stripe-continuation.js';
 /** A SetupIntent confirm's path, as Stripe.js sends it. */
 export const STRIPE_SETUP_INTENT_CONFIRM = /^\/v1\/setup_intents\/seti_[A-Za-z0-9]+\/confirm$/;
 const PAYMENT_METHOD_ID = /^pm_[A-Za-z0-9]{1,250}$/;
-// The other ways a confirm can say what it pays with. A body that already names
-// one is not the shape rewritten here.
-const OTHER_WAYS_TO_PAY = new Set(['payment_method', 'source', 'confirmation_token']);
 /**
  * The page's SetupIntent confirm, paying with `paymentMethod` instead of the
- * card it carries: every `payment_method_data[...]` field goes (the card, and
- * the billing details and telemetry Stripe.js sends beside it; the payment
- * method already carries the billing details of the approved request), and
- * `payment_method=<id>` takes the place of the first one. Every other field
- * stays byte for byte as the page wrote it (client_secret, key,
- * expected_payment_method_type, use_stripe_sdk, return_url, mandate and option
- * fields). Null, and nothing is rewritten, when the id is not a payment
- * method's, when a key cannot be decoded, when the body already names another
- * way to pay (payment_method, source, confirmation_token), or when it carries
- * no payment_method_data at all.
+ * card it carries (confirmPayingWith, with the payment method as the way to
+ * pay). Null, and nothing is rewritten, when the id is not a payment method's,
+ * when a key cannot be decoded, when the body already names another way to pay
+ * (payment_method, source, confirmation_token), or when it carries no
+ * payment_method_data at all.
  */
 export function setupConfirmPayingWith(body, paymentMethod) {
-    if (!PAYMENT_METHOD_ID.test(paymentMethod) || typeof body !== 'string' || body === '')
+    if (!PAYMENT_METHOD_ID.test(paymentMethod))
         return null;
-    const kept = [];
-    let replaced = false;
-    for (const chunk of body.split('&')) {
-        if (chunk === '')
-            continue;
-        const eq = chunk.indexOf('=');
-        let key;
-        try {
-            key = decodeURIComponent((eq < 0 ? chunk : chunk.slice(0, eq)).replace(/\+/g, ' '));
-        }
-        catch {
-            return null;
-        }
-        if (OTHER_WAYS_TO_PAY.has(key))
-            return null;
-        if (key.startsWith('payment_method_data[')) {
-            if (!replaced)
-                kept.push(`payment_method=${paymentMethod}`);
-            replaced = true;
-            continue;
-        }
-        kept.push(chunk);
-    }
-    return replaced ? kept.join('&') : null;
+    return confirmPayingWith(body, { field: 'payment_method', id: paymentMethod });
 }

package/dist/token-repeats.d.ts

@@ -0,0 +1,32 @@
+import type { ReplayResponse } from './client.js';
+/** How long an approved answer may answer a re-send: the approval's own lifetime (cdp.ts HOSTED_FORM_REPEAT_QUIET_MS). */
+export declare const TOKEN_REPEAT_WINDOW_MS: number;
+/** How many re-sends one approved answer answers. Shopify's frame sent 11 in a row; past this the re-send is held. */
+export declare const MAX_TOKEN_REPEATS = 3;
+export interface TokenRepeatAnswer {
+    authorizationId: string;
+    response: {
+        status: number;
+        headers: Record<string, string>;
+        body: string;
+    };
+}
+export declare class TokenRepeats {
+    private readonly now;
+    private last;
+    constructor(now?: () => number);
+    /**
+     * Keep the answer a token replay handed to a card request, once it reached the page. Only a plain token answer the
+     * processor accepted (a 2xx): a hosted form, a card endpoint, a client-side encryption or a device's own send is
+     * never answered again from here. A new answer replaces the last, so an earlier approval answers nothing.
+     */
+    remember(frame: unknown, url: string, body: string | null, replay: ReplayResponse): void;
+    /**
+     * The stored answer for a byte-identical re-send from the same frame under `authorizationId`, inside the window and
+     * the count, or null. Handing one out reserves a place in the count; the caller gives it back (released) when the
+     * answer never reached the page.
+     */
+    answerFor(frame: unknown, url: string, body: string | null, authorizationId: string | null): TokenRepeatAnswer | null;
+    /** Give back a place answerFor reserved for an answer that never reached the page. */
+    released(authorizationId: string): void;
+}

package/dist/token-repeats.js

@@ -0,0 +1,64 @@
+// The page's own re-send of a card request this attachment already answered with an approved token.
+//
+// Once the cardholder's device replayed the card and the processor's token reached the page, a checkout can send the
+// very same card request again before the merchant confirms the order: Shopify's card frame did, after a checkout that
+// sat a few minutes between its total and Pay (lexmod.com, expedusa.com and four more stores, 2026-10-27 to 2026-11-05).
+// The SDK held every such re-send while the merchant resolver read the order as pending (lifecycle.ts resolve), so the
+// page never got a token it would submit and the order stayed unconfirmed with the card already out of the device.
+//
+// TokenRepeats keeps the one answer this attachment last handed a plain token request, and hands it out again only for
+// a byte-identical request from the same frame to the same URL under the same approval: the same card fields, the same
+// amount the approval was given for, and no new question for the cardholder. The pre-claim gate (pre-claim.ts tokenRepeatPreClaim) also
+// asks the merchant resolver first and answers only while the order reads pending, so the stored token never reaches a
+// later purchase. A token the processor takes once is refused by the processor the second time, and nothing charges
+// twice: the page holds the same token it already had, never a second payment.
+/** How long an approved answer may answer a re-send: the approval's own lifetime (cdp.ts HOSTED_FORM_REPEAT_QUIET_MS). */
+export const TOKEN_REPEAT_WINDOW_MS = 15 * 60_000;
+/** How many re-sends one approved answer answers. Shopify's frame sent 11 in a row; past this the re-send is held. */
+export const MAX_TOKEN_REPEATS = 3;
+export class TokenRepeats {
+    now;
+    last = null;
+    constructor(now = Date.now) {
+        this.now = now;
+    }
+    /**
+     * Keep the answer a token replay handed to a card request, once it reached the page. Only a plain token answer the
+     * processor accepted (a 2xx): a hosted form, a card endpoint, a client-side encryption or a device's own send is
+     * never answered again from here. A new answer replaces the last, so an earlier approval answers nothing.
+     */
+    remember(frame, url, body, replay) {
+        try {
+            if (frame === undefined || frame === null || frame === '' || body === null || (replay.mode !== undefined && replay.mode !== 'token'))
+                return;
+            const { status, headers } = replay;
+            if (!(status >= 200 && status < 300) || typeof replay.body !== 'string')
+                return;
+            this.last = { frame, url, body, authorizationId: replay.authorizationId, response: { status, headers: { ...headers }, body: replay.body }, at: this.now(), answered: 0 };
+        }
+        catch {
+            this.last = null;
+        }
+    }
+    /**
+     * The stored answer for a byte-identical re-send from the same frame under `authorizationId`, inside the window and
+     * the count, or null. Handing one out reserves a place in the count; the caller gives it back (released) when the
+     * answer never reached the page.
+     */
+    answerFor(frame, url, body, authorizationId) {
+        const last = this.last;
+        if (!last || !authorizationId || body === null || frame === undefined || frame === null || frame === '')
+            return null;
+        if (last.authorizationId !== authorizationId || last.frame !== frame || last.url !== url || last.body !== body)
+            return null;
+        if (this.now() - last.at >= TOKEN_REPEAT_WINDOW_MS || last.answered >= MAX_TOKEN_REPEATS)
+            return null;
+        last.answered += 1;
+        return { authorizationId, response: { ...last.response, headers: { ...last.response.headers } } };
+    }
+    /** Give back a place answerFor reserved for an answer that never reached the page. */
+    released(authorizationId) {
+        if (this.last?.authorizationId === authorizationId && this.last.answered > 0)
+            this.last.answered -= 1;
+    }
+}

package/examples/preflight/kernel-native/inventory.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "catalog_version": "2026-09-15.1",
-  "catalog_sha256": "86bf0b382e6d847b49d00310f262cf697a0189d4badf89c36ebfb595e07a005b",
+  "catalog_sha256": "87d4e75b981d7186a2cd39b6f382717acf5b757d053ed389cb8e181f261f0a49",
   "baseline_version": "kernel-native-docs-2026-09-11.1",
   "baseline_sha256": "d86722f49633d8223fccae54cd3d485df4375aee06aa156a273cc689b7c8507c",
   "native_build": null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.24.1",
+  "version": "0.25.0",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; buy asks the Purchase API for a cart and places it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",
@@ -30,7 +30,7 @@
     "_comment_test": "check:built runs first and names the command when a file the build generates (the copies in src/, the preflight contracts in dist/, the Kernel inventory) is missing or stale; verify:pack runs last, on the same dist.",
     "check:built": "node scripts/generate-payment-core.mjs --check && node scripts/generate-url-masks.mjs --check && node scripts/generate-capabilities.mjs --check && node scripts/generate-agent-amount.mjs --check && node scripts/generate-preflight-contract.mjs --check && node scripts/generate-kernel-native-inventory.mjs --check",
     "verify:pack": "node scripts/verify-pack.mjs",
-    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paytrail.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs payrexx.test.mjs payrexx-follow-ups.test.mjs payrexx-adapters.test.mjs nike-order.test.mjs nike-order-adapters.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs openpay.test.mjs processout.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs agentcard.test.mjs buy.test.mjs clean-dist.test.mjs approvals.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs sbps.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs gopay.test.mjs paygent.test.mjs twoc2p.test.mjs tap-payments.test.mjs pay-nl.test.mjs toast.test.mjs redact-url.test.mjs hosted-entry.test.mjs comgate.test.mjs przelewy24.test.mjs tokenex-iframe.test.mjs transbank.test.mjs sumup.test.mjs clover.test.mjs eximbay.test.mjs xendit.test.mjs omise.test.mjs fastspring.test.mjs amazon-payment-services.test.mjs barion.test.mjs paymob.test.mjs payu-latam.test.mjs nexi-checkout.test.mjs oceanpayment.test.mjs pin-payments.test.mjs payplug.test.mjs cardlink-vpos.test.mjs eghl.test.mjs paymentwall.test.mjs vtex-payments.test.mjs vtex-payments-window.test.mjs iyzico.test.mjs usaepay.test.mjs viva-wallet.test.mjs aurus.test.mjs monei.test.mjs paystack.test.mjs frisbii.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs browser-tests.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
+    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paytrail.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs payrexx.test.mjs payrexx-follow-ups.test.mjs payrexx-adapters.test.mjs nike-order.test.mjs nike-order-adapters.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-payment-continuation.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs openpay.test.mjs processout.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs agentcard.test.mjs buy.test.mjs clean-dist.test.mjs approvals.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs sbps.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs gopay.test.mjs paygent.test.mjs twoc2p.test.mjs tap-payments.test.mjs pay-nl.test.mjs toast.test.mjs redact-url.test.mjs hosted-entry.test.mjs comgate.test.mjs przelewy24.test.mjs tokenex-iframe.test.mjs transbank.test.mjs sumup.test.mjs clover.test.mjs eximbay.test.mjs xendit.test.mjs omise.test.mjs fastspring.test.mjs amazon-payment-services.test.mjs barion.test.mjs paymob.test.mjs payu-latam.test.mjs nexi-checkout.test.mjs oceanpayment.test.mjs pin-payments.test.mjs payplug.test.mjs cardlink-vpos.test.mjs eghl.test.mjs paymentwall.test.mjs vtex-payments.test.mjs vtex-payments-window.test.mjs iyzico.test.mjs usaepay.test.mjs viva-wallet.test.mjs aurus.test.mjs monei.test.mjs paystack.test.mjs frisbii.test.mjs token-repeat.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs browser-tests.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
     "test:browser": "node browser-tests.mjs",
     "check:payment-core": "node scripts/generate-payment-core.mjs --check",
     "test:preflight": "node --test preflight-package.test.mjs preflight-collector.test.mjs kernel-native-qualification.test.mjs",