@atbas/m-mcp 0.1.0

package/knowledge/templates/php/checkout-redirect.tmpl

@@ -0,0 +1,149 @@
+<?php
+/**
+ * JazzCash — {{FLOW_TITLE}}
+ *
+ * Generated by the JazzCash MCP server from {{FLOW_ID}} ({{CORPUS_VERSION}} guides).
+ * Sources: {{DOC_SOURCES}}
+ *
+ * SAFETY NOTES
+ *  - Sandbox and production use the SAME URL. The environment is decided entirely
+ *    by the credentials below. Going live means swapping credentials.
+ *  - The Integrity Salt is the HMAC key. It must never reach the browser.
+ *  - pp_ReturnURL must be byte-identical to the URL registered in the portal.
+ */
+
+declare(strict_types=1);
+
+date_default_timezone_set('Asia/Karachi');
+
+// --- Credentials -------------------------------------------------------------
+// Read from the environment. Never hard-code these and never commit them.
+$merchantId    = getenv('JAZZCASH_MERCHANT_ID')    ?: '';
+$password      = getenv('JAZZCASH_PASSWORD')       ?: '';
+$integritySalt = getenv('JAZZCASH_INTEGRITY_SALT') ?: '';
+$returnUrl     = getenv('JAZZCASH_RETURN_URL')     ?: '';
+
+if ($merchantId === '' || $password === '' || $integritySalt === '' || $returnUrl === '') {
+    http_response_code(500);
+    exit('JazzCash credentials are not configured.');
+}
+
+$postUrl = '{{ENDPOINT}}';
+
+// pp_TxnRefNo is annotated [20AN] in the guides: at most 20 letters and digits.
+const JAZZCASH_MAX_REFERENCE_LENGTH = 20;
+const JAZZCASH_REFERENCE_ALPHABET   = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
+
+/**
+ * Reference that stays unique inside a single millisecond.
+ *
+ * The clock alone is not enough: two orders placed in the same millisecond
+ * produce the same reference, and the gateway rejects the second as a duplicate.
+ * The random suffix fills whatever the prefix and the timestamp leave of the
+ * 20-character budget. random_int() is the cryptographic generator; rand() and
+ * mt_rand() are not.
+ */
+function jazzcash_reference(string $prefix): string
+{
+    $stamp = date('YmdHis');
+    $room  = JAZZCASH_MAX_REFERENCE_LENGTH - strlen($prefix) - strlen($stamp);
+
+    if ($room < 1) {
+        throw new RuntimeException(
+            'Reference prefix "' . $prefix . '" leaves no room inside the '
+            . JAZZCASH_MAX_REFERENCE_LENGTH . '-character limit.'
+        );
+    }
+
+    $alphabet = JAZZCASH_REFERENCE_ALPHABET;
+    $suffix   = '';
+    for ($index = 0; $index < $room; $index++) {
+        $suffix .= $alphabet[random_int(0, strlen($alphabet) - 1)];
+    }
+
+    return $prefix . $stamp . $suffix;
+}
+
+// --- Order data --------------------------------------------------------------
+// Replace these with your real order. $amountMajor is in rupees.
+$amountMajor     = '1.00';
+$billReference   = 'billref001';
+$description     = 'Test transaction description';
+
+// pp_Amount is in MINOR units: the gateway reads the last two digits as decimals.
+// bcmul keeps this exact; never use floating point for money.
+$amountMinor = bcmul($amountMajor, '100', 0);
+
+// pp_TxnRefNo must be unique for every transaction. Replace TRN with your own
+// three-letter merchant prefix, as the guides recommend.
+$txnRefNo = jazzcash_reference('TRN');
+
+$params = [
+{{PARAMS}}
+];
+
+// Overlay the runtime values.
+$params['pp_MerchantID']        = $merchantId;
+$params['pp_Password']          = $password;
+$params['pp_ReturnURL']         = $returnUrl;
+$params['pp_TxnRefNo']          = $txnRefNo;
+$params['pp_Amount']            = $amountMinor;
+$params['pp_BillReference']     = $billReference;
+$params['pp_Description']       = $description;
+$params['pp_TxnDateTime']       = date('YmdHis');
+$params['pp_TxnExpiryDateTime'] = date('YmdHis', strtotime('+1 day'));
+
+/**
+ * Build pp_SecureHash.
+ *
+ * Sort by parameter NAME ascending ASCII, join the non-empty VALUES with "&",
+ * prepend the Integrity Salt, then HMAC-SHA256 with the salt as the key.
+ *
+ * Two deliberate differences from the sample in the official guide, both bug fixes:
+ *  1. SORT_STRING, so ordering is a plain string comparison as the spec requires.
+ *     Plain ksort() uses SORT_REGULAR, which is not guaranteed to be one.
+ *  2. Strict emptiness test. The guide uses `$value != ""`, which is FALSE for
+ *     integer 0 in PHP and silently drops that field from the hash.
+ */
+function jazzcash_secure_hash(array $params, string $integritySalt): string
+{
+    unset($params['pp_SecureHash']);
+    ksort($params, SORT_STRING);
+
+    $values = [];
+    foreach ($params as $value) {
+        if ($value !== null && (string) $value !== '') {
+            $values[] = (string) $value;
+        }
+    }
+
+    $message = $integritySalt . ($values === [] ? '' : '&' . implode('&', $values));
+
+    return hash_hmac('sha256', $message, $integritySalt);
+}
+
+$params['pp_SecureHash'] = jazzcash_secure_hash($params, $integritySalt);
+?>
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <title>Checkout | JazzCash</title>
+</head>
+<body>
+  <h1>{{FLOW_TITLE}}</h1>
+  <p>Transaction reference: <strong><?= htmlspecialchars($txnRefNo, ENT_QUOTES, 'UTF-8') ?></strong></p>
+  <p>Amount: <strong>PKR <?= htmlspecialchars($amountMajor, ENT_QUOTES, 'UTF-8') ?></strong></p>
+
+  <form method="post" action="<?= htmlspecialchars($postUrl, ENT_QUOTES, 'UTF-8') ?>">
+    <?php foreach ($params as $name => $value): ?>
+      <input type="hidden"
+             name="<?= htmlspecialchars((string) $name, ENT_QUOTES, 'UTF-8') ?>"
+             value="<?= htmlspecialchars((string) $value, ENT_QUOTES, 'UTF-8') ?>">
+    <?php endforeach; ?>
+    <button type="submit">Proceed to checkout</button>
+  </form>
+
+  <p><small>You will be redirected to the JazzCash secure payment page.</small></p>
+</body>
+</html>

package/knowledge/templates/php/ipn-handler.tmpl

@@ -0,0 +1,105 @@
+<?php
+/**
+ * JazzCash IPN (Instant Payment Notification) listener
+ *
+ * Generated by the JazzCash MCP server ({{CORPUS_VERSION}} guides).
+ * Sources: {{DOC_SOURCES}}
+ *
+ * Register this URL under Integration > Credentials in the merchant portal.
+ * Framework: {{FRAMEWORK}}
+ *
+ * CONTRACT
+ *  - Respond within 60 seconds. JazzCash retries twice on failure or timeout.
+ *  - Therefore this handler MUST be idempotent: the same notification can
+ *    legitimately arrive three times.
+ *  - This URL is public. Anyone can post to it. VERIFY THE HASH FIRST.
+ *  - In an inbound IPN the payment outcome is in pp_ResponseCode: 121 succeeded,
+ *    199/999 failed. (In a Status Inquiry response it is pp_PaymentResponseCode.)
+ */
+
+declare(strict_types=1);
+
+date_default_timezone_set('Asia/Karachi');
+
+header('Content-Type: application/json');
+
+$integritySalt = getenv('JAZZCASH_INTEGRITY_SALT') ?: '';
+if ($integritySalt === '') {
+    http_response_code(500);
+    exit(json_encode(['pp_ResponseCode' => '500', 'pp_ResponseMessage' => 'Not configured']));
+}
+
+function jazzcash_secure_hash(array $params, string $integritySalt): string
+{
+    unset($params['pp_SecureHash'], $params['SecureHash']);
+    ksort($params, SORT_STRING);
+
+    $values = [];
+    foreach ($params as $value) {
+        // The gateway sends JSON null in IPN payloads even though merchants are
+        // told never to send null. Treat null as empty when hashing.
+        if ($value !== null && (string) $value !== '') {
+            $values[] = (string) $value;
+        }
+    }
+
+    $message = $integritySalt . ($values === [] ? '' : '&' . implode('&', $values));
+
+    return hash_hmac('sha256', $message, $integritySalt);
+}
+
+function jazzcash_ack(string $message): string
+{
+    $body = ['pp_ResponseCode' => '000', 'pp_ResponseMessage' => $message];
+    // Acknowledge with our own hash over the acknowledgement fields.
+    $body['pp_SecureHash'] = jazzcash_secure_hash($body, getenv('JAZZCASH_INTEGRITY_SALT') ?: '');
+
+    return json_encode($body, JSON_UNESCAPED_SLASHES);
+}
+
+$raw          = file_get_contents('php://input') ?: '';
+$notification = json_decode($raw, true);
+
+if (!is_array($notification)) {
+    http_response_code(400);
+    exit(json_encode(['pp_ResponseCode' => '400', 'pp_ResponseMessage' => 'Malformed body']));
+}
+
+// 1. Verify the hash BEFORE anything else.
+$supplied   = (string) ($notification['pp_SecureHash'] ?? '');
+$recomputed = jazzcash_secure_hash($notification, $integritySalt);
+
+if ($supplied === '' || !hash_equals(strtolower($recomputed), strtolower(trim($supplied)))) {
+    error_log('JazzCash IPN rejected: secure hash did not verify.');
+    http_response_code(400);
+    exit(json_encode(['pp_ResponseCode' => '400', 'pp_ResponseMessage' => 'Invalid secure hash']));
+}
+
+$txnRefNo     = (string) ($notification['pp_TxnRefNo'] ?? '');
+$responseCode = (string) ($notification['pp_ResponseCode'] ?? '');
+
+// 2. Look up the order. Replace with your own persistence layer.
+// $order = find_order_by_reference($txnRefNo);
+// if ($order === null) { ... acknowledge and investigate ... }
+
+// 3. Idempotency: a retry must not fulfil the order twice.
+// if ($order->isPaid()) { echo jazzcash_ack('IPN received successfully'); exit; }
+
+// 4. Confirm the amount matches what you recorded, so a replayed or altered
+//    notification cannot mark a large order paid from a small transaction.
+// if ((string) $order->amountMinorUnits !== (string) ($notification['pp_Amount'] ?? '')) { ... }
+
+// 5. Interpret the outcome.
+if ($responseCode === '121') {
+    // Paid. Mark the order paid, then do slow work asynchronously.
+    // mark_order_paid($txnRefNo, $notification);
+} elseif ($responseCode === '199' || $responseCode === '999') {
+    // Failed. Do not release goods.
+    // mark_order_failed($txnRefNo, $notification);
+} else {
+    // Undocumented code: unresolved, NOT failed. Reconcile with Status Inquiry.
+    error_log('JazzCash IPN carried undocumented code ' . $responseCode . ' for ' . $txnRefNo);
+}
+
+// 6. Acknowledge well inside the 60-second window.
+echo jazzcash_ack('IPN received successfully');

package/knowledge/templates/php/rest-client.tmpl

@@ -0,0 +1,191 @@
+<?php
+/**
+ * JazzCash — {{FLOW_TITLE}}
+ *
+ * Generated by the JazzCash MCP server from {{FLOW_ID}} ({{CORPUS_VERSION}} guides).
+ * Sources: {{DOC_SOURCES}}
+ *
+ * SAFETY NOTES
+ *  - Sandbox and production use the SAME URL ({{ENDPOINT}}). The environment is
+ *    decided entirely by the credentials. Confirm which are loaded before running.
+ *  - Moves money: {{MOVES_MONEY}}.
+ */
+
+declare(strict_types=1);
+
+date_default_timezone_set('Asia/Karachi');
+
+const JAZZCASH_ENDPOINT     = '{{ENDPOINT}}';
+const JAZZCASH_TIMEOUT_SECS = 30;
+
+// pp_TxnRefNo and pp_RequestID are annotated [20AN] in the guides: at most 20
+// letters and digits.
+const JAZZCASH_MAX_REFERENCE_LENGTH = 20;
+const JAZZCASH_REFERENCE_ALPHABET   = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
+
+/**
+ * Reference that stays unique inside a single millisecond.
+ *
+ * The clock alone is not enough: two orders placed in the same millisecond
+ * produce the same reference, and the gateway rejects the second as a duplicate.
+ * The random suffix fills whatever the prefix and the timestamp leave of the
+ * 20-character budget. random_int() is the cryptographic generator; rand() and
+ * mt_rand() are not.
+ */
+function jazzcash_reference(string $prefix): string
+{
+    $stamp = date('YmdHis');
+    $room  = JAZZCASH_MAX_REFERENCE_LENGTH - strlen($prefix) - strlen($stamp);
+
+    if ($room < 1) {
+        throw new RuntimeException(
+            'Reference prefix "' . $prefix . '" leaves no room inside the '
+            . JAZZCASH_MAX_REFERENCE_LENGTH . '-character limit.'
+        );
+    }
+
+    $alphabet = JAZZCASH_REFERENCE_ALPHABET;
+    $suffix   = '';
+    for ($index = 0; $index < $room; $index++) {
+        $suffix .= $alphabet[random_int(0, strlen($alphabet) - 1)];
+    }
+
+    return $prefix . $stamp . $suffix;
+}
+
+/**
+ * Convert rupees to the minor units pp_Amount carries.
+ *
+ * bcmul keeps this exact. Never use floating point for money: 100.50 * 100 is
+ * 10049.999... in binary floating point, and the gateway would take PKR 100.49.
+ */
+function jazzcash_to_minor_units(string $majorAmount): string
+{
+    if (preg_match('/^\d+(\.\d{1,2})?$/', trim($majorAmount)) !== 1) {
+        throw new RuntimeException(
+            'Amount "' . $majorAmount . '" must be a positive value with at most two decimal places.'
+        );
+    }
+
+    return bcmul(trim($majorAmount), '100', 0);
+}
+
+/**
+ * Build pp_SecureHash: sort by name, join non-empty values with "&",
+ * prepend the Integrity Salt, HMAC-SHA256 keyed by the salt.
+ */
+function jazzcash_secure_hash(array $params, string $integritySalt): string
+{
+    unset($params['pp_SecureHash'], $params['SecureHash']);
+    ksort($params, SORT_STRING);
+
+    $values = [];
+    foreach ($params as $value) {
+        if ($value !== null && (string) $value !== '') {
+            $values[] = (string) $value;
+        }
+    }
+
+    $message = $integritySalt . ($values === [] ? '' : '&' . implode('&', $values));
+
+    return hash_hmac('sha256', $message, $integritySalt);
+}
+
+/**
+ * Verify a hash in constant time and case-insensitively.
+ *
+ * JazzCash returns uppercase hex while hash_hmac produces lowercase; both denote
+ * the same digest.
+ */
+function jazzcash_hash_matches(string $expected, string $actual): bool
+{
+    return hash_equals(strtolower(trim($expected)), strtolower(trim($actual)));
+}
+
+/**
+ * Send one request and return the decoded response.
+ *
+ * @throws RuntimeException on transport failure or an unparseable body.
+ */
+function jazzcash_post(array $params): array
+{
+    $body = json_encode($params, JSON_THROW_ON_ERROR | JSON_UNESCAPED_SLASHES);
+
+    $handle = curl_init(JAZZCASH_ENDPOINT);
+    curl_setopt_array($handle, [
+        CURLOPT_POST           => true,
+        CURLOPT_POSTFIELDS     => $body,
+        CURLOPT_RETURNTRANSFER => true,
+        CURLOPT_TIMEOUT        => JAZZCASH_TIMEOUT_SECS,
+        CURLOPT_HTTPHEADER     => ['Content-Type: application/json', 'Accept: application/json'],
+    ]);
+
+    $raw    = curl_exec($handle);
+    $error  = curl_error($handle);
+    $status = curl_getinfo($handle, CURLINFO_RESPONSE_CODE);
+    curl_close($handle);
+
+    if ($raw === false) {
+        // Never assume a transport failure means the payment did not happen.
+        // Resolve it with the Status Inquiry API before retrying.
+        throw new RuntimeException('JazzCash request failed: ' . $error);
+    }
+
+    $decoded = json_decode((string) $raw, true);
+    if (!is_array($decoded)) {
+        throw new RuntimeException('JazzCash returned a non-JSON body with HTTP ' . $status);
+    }
+
+    return $decoded;
+}
+
+// --- Credentials -------------------------------------------------------------
+$merchantId    = getenv('JAZZCASH_MERCHANT_ID')    ?: '';
+$password      = getenv('JAZZCASH_PASSWORD')       ?: '';
+$integritySalt = getenv('JAZZCASH_INTEGRITY_SALT') ?: '';
+
+if ($merchantId === '' || $password === '' || $integritySalt === '') {
+    throw new RuntimeException('JazzCash credentials are not configured.');
+}
+
+// --- Request -----------------------------------------------------------------
+// Every value marked TODO must be supplied by your application. pp_Amount is in
+// MINOR units: pass your rupee total through jazzcash_to_minor_units('100.00')
+// rather than multiplying a float, so the conversion is exact.
+$params = [
+{{PARAMS}}
+];
+
+$params['pp_MerchantID'] = $merchantId;
+$params['pp_Password']   = $password;
+{{RUNTIME_OVERRIDES}}
+
+$params['pp_SecureHash'] = jazzcash_secure_hash($params, $integritySalt);
+
+$response = jazzcash_post($params);
+
+// --- Response ----------------------------------------------------------------
+$responseCode = $response['{{SUCCESS_FIELD}}'] ?? '';
+
+if ($responseCode === '{{SUCCESS_VALUE}}') {
+{{SETTLEMENT_CHECK}}    // The API call succeeded. For Status Inquiry this says nothing about the
+    // payment: read pp_PaymentResponseCode, where 121 means completed.
+{{SUCCESS_REPORT}}
+} else {
+    // Do NOT treat an unrecognised code as a definite failure. Resolve it with
+    // the Status Inquiry API before refunding or re-charging.
+    echo "Unresolved or failed. Code: " . $responseCode . PHP_EOL;
+}
+
+// Verify the response hash where one is returned. Note this flow returns it in
+// {{RESPONSE_HASH_FIELD}}; card and BNPL refunds use the unprefixed spelling.
+$responseHash = $response['{{RESPONSE_HASH_FIELD}}'] ?? '';
+if ($responseHash !== '') {
+    $recomputed = jazzcash_secure_hash($response, $integritySalt);
+    if (!jazzcash_hash_matches($recomputed, $responseHash)) {
+        // JazzCash does not document which response fields feed this hash, so a
+        // mismatch here means UNVERIFIED, not proven tampering. Log it and
+        // reconcile through Status Inquiry rather than rejecting the payment.
+        error_log('JazzCash response hash could not be verified for ' . ($response['pp_TxnRefNo'] ?? 'unknown'));
+    }
+}

package/knowledge/templates/php/wallet-linking.tmpl

@@ -0,0 +1,137 @@
+<?php
+/**
+ * JazzCash — MWallet linking form
+ *
+ * Generated by the JazzCash MCP server from {{FLOW_ID}} ({{CORPUS_VERSION}} guides).
+ * Sources: {{DOC_SOURCES}}
+ *
+ *  - Sandbox and production use the SAME URL. The environment is decided by the
+ *    credentials alone: going live is a credential swap, not a URL change.
+ *
+ * TWO CORRECTIONS TO THE OFFICIAL SAMPLE, both deliberate:
+ *
+ *  1. The sample in the guide computes the hash in browser JavaScript with
+ *     `const INTEGRITY_SALT = "..."` in the page source. The Integrity Salt is
+ *     the HMAC key: publishing it lets anyone forge a valid pp_SecureHash for
+ *     your merchant account. This file computes the hash server-side and renders
+ *     only the finished hash.
+ *
+ *  2. The sample posts to https://pgw.jazzcash.com.pk/..., contradicting the
+ *     endpoint table and screenshot in the same document. This file uses the
+ *     endpoint from the table: {{ENDPOINT}}
+ */
+
+declare(strict_types=1);
+
+date_default_timezone_set('Asia/Karachi');
+
+$merchantId    = getenv('JAZZCASH_MERCHANT_ID')    ?: '';
+$password      = getenv('JAZZCASH_PASSWORD')       ?: '';
+$integritySalt = getenv('JAZZCASH_INTEGRITY_SALT') ?: '';
+$returnUrl     = getenv('JAZZCASH_RETURN_URL')     ?: '';
+
+if ($merchantId === '' || $password === '' || $integritySalt === '' || $returnUrl === '') {
+    http_response_code(500);
+    exit('JazzCash credentials are not configured.');
+}
+
+$postUrl = '{{ENDPOINT}}';
+
+// The wallet number to link. Supply this from your own session or form.
+$msisdn = $_POST['msisdn'] ?? '';
+if (!preg_match('/^03[0-9]{9}$/', (string) $msisdn)) {
+    http_response_code(400);
+    exit('A Pakistani mobile wallet number in the form 03XXXXXXXXX is required.');
+}
+
+// pp_RequestID is annotated [20AN] in the guides: at most 20 letters and digits.
+const JAZZCASH_MAX_REFERENCE_LENGTH = 20;
+const JAZZCASH_REFERENCE_ALPHABET   = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
+
+/**
+ * Reference that stays unique inside a single millisecond.
+ *
+ * The clock alone is not enough: two linking attempts started in the same
+ * millisecond produce the same pp_RequestID, and the gateway rejects the second
+ * as a duplicate. random_int() is the cryptographic generator; rand() and
+ * mt_rand() are not.
+ */
+function jazzcash_reference(string $prefix): string
+{
+    $stamp = date('YmdHis');
+    $room  = JAZZCASH_MAX_REFERENCE_LENGTH - strlen($prefix) - strlen($stamp);
+
+    if ($room < 1) {
+        throw new RuntimeException(
+            'Reference prefix "' . $prefix . '" leaves no room inside the '
+            . JAZZCASH_MAX_REFERENCE_LENGTH . '-character limit.'
+        );
+    }
+
+    $alphabet = JAZZCASH_REFERENCE_ALPHABET;
+    $suffix   = '';
+    for ($index = 0; $index < $room; $index++) {
+        $suffix .= $alphabet[random_int(0, strlen($alphabet) - 1)];
+    }
+
+    return $prefix . $stamp . $suffix;
+}
+
+// pp_RequestID must be unique for every linking attempt.
+$requestId = jazzcash_reference('R');
+
+$params = [
+{{PARAMS}}
+];
+
+$params['pp_MerchantID'] = $merchantId;
+$params['pp_Password']   = $password;
+$params['pp_MSISDN']     = (string) $msisdn;
+$params['pp_RequestID']  = $requestId;
+$params['pp_ReturnURL']  = $returnUrl;
+
+function jazzcash_secure_hash(array $params, string $integritySalt): string
+{
+    unset($params['pp_SecureHash']);
+    ksort($params, SORT_STRING);
+
+    $values = [];
+    foreach ($params as $value) {
+        if ($value !== null && (string) $value !== '') {
+            $values[] = (string) $value;
+        }
+    }
+
+    $message = $integritySalt . ($values === [] ? '' : '&' . implode('&', $values));
+
+    return hash_hmac('sha256', $message, $integritySalt);
+}
+
+$params['pp_SecureHash'] = jazzcash_secure_hash($params, $integritySalt);
+?>
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <title>Link your JazzCash wallet</title>
+</head>
+<body>
+  <h1>Link your JazzCash wallet</h1>
+  <p>You will be asked for your MPIN on the JazzCash page.</p>
+
+  <form id="link-wallet" method="post" action="<?= htmlspecialchars($postUrl, ENT_QUOTES, 'UTF-8') ?>">
+    <?php foreach ($params as $name => $value): ?>
+      <input type="hidden"
+             name="<?= htmlspecialchars((string) $name, ENT_QUOTES, 'UTF-8') ?>"
+             value="<?= htmlspecialchars((string) $value, ENT_QUOTES, 'UTF-8') ?>">
+    <?php endforeach; ?>
+    <button type="submit">Continue</button>
+  </form>
+
+  <?php
+  // On return, JazzCash posts a payment token to your Return URL. Store it
+  // against the customer and charge it later with the token payment API.
+  // Call the Token Inquiry API before charging: the customer may have unlinked.
+  ?>
+</body>
+</html>