@fat-zebra/sdk 2.0.8-beta.3 → 2.1.0-beta.3

package/CHANGELOG.md

@@ -5,103 +5,142 @@ All notable changes to the Fat Zebra JS SDK will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.1.0] - 2026-06-02
+
+> **Upgrade recommended.** This release fixes a critical issue where the React SDK could silently fall back to the legacy 3DS API, which is being decommissioned. Merchants should upgrade to avoid potential production failures.
+
+### Changed
+
+- Removed feature flag to conditionally enable the new ThreeDSecure flow. The ThreeDSecure flow is now always used for authenticating 3DS transactions.
+
+### Fixed
+
+- Fixed the ThreeDSecure flow failing silently when `accessToken` is supplied via config rather than stored in `localStorage`
+- Fixed an issue where 3DS processing could silently fall back to the legacy 3DS API, which would cause failures once the legacy API is decommissioned
+
 ## [2.0.6] - 2026-05-27
 
 ### Added
+
 - Improved reliability of the ThreeDSecure flow to prevent duplicate processing when a payment is retried or initiated more than once
 
 ### Changed
+
 - React SDK ThreeDSecure flow brought to parity with the core SDK
 
 ## [2.0.5] - 2026-05-21
 
 ### Fixed
+
 - Fixed an issue where the device profiling step in the ThreeDSecure flow could trigger card enrollment multiple times if the device profile event fired more than once
 
 ## [2.0.4] - 2026-05-20
 
 ### Fixed
+
 - Fixed an issue where triggering the ThreeDSecure flow multiple times (e.g. in a single-page application) could register duplicate event listeners, leading to multiple enrollment attempts
 
 ## [2.0.3] - 2026-05-19
 
 ### Fixed
+
 - Fixed an issue in SPA environments where the Cardinal SCA `payments.validated` handler could accumulate across payment flows, causing stale callbacks to fire on subsequent transactions
 
 ## [2.0.2] - 2026-05-14
 
 ### Changed
+
 - Default ThreeDSecure challenge window size changed from full-page to 500×600px
 
 ### Fixed
+
 - ThreeDSecure challenge window iframe errors are now correctly reported rather than silently ignored
 
 ## [2.0.1] - 2026-05-11
 
 ### Fixed
+
 - Resolved an issue causing delayed rendering of the payment form in `renderPaymentsPage`
 - Payment source is now correctly included in SDK tokenisation request events
 
 ### Security
+
 - Bumped axios from 1.13.5 to 1.16.0 to address known vulnerabilities
 
 ## [2.0.0] - 2026-04-02
 
 ### Changed
+
 - **Upgraded 3DS2 authentication flow** — replaced the previous CyberSource Cardinal/Songbird library with a new SDK-native implementation backed directly by Fat Zebra's infrastructure. The new flow supports a configurable challenge window (250×400, 390×400, 500×600, 600×400, or full-page) and handles device fingerprinting internally. No changes are required to existing integrations; the correct flow is selected automatically.
 
 ### Security
+
 - Bumped handlebars from 4.7.8 to 4.7.9 to address known vulnerabilities
 - Bumped axios to 1.15.0
 
 ## [1.5.14] - 2026-03-10
 
 ### Security
+
 - Addressed known vulnerabilities in transitive dependencies (axios, minimatch, glob)
 
 ## [1.5.12] - 2025-10-14
+
 ## Updated
+
 - Bump to react-dom and react 19 from react 18
-- Bump husky from 8.0.3 to 9.1.7 
+- Bump husky from 8.0.3 to 9.1.7
 - Bump jest-environment-jsdom from 29.6.1 to 30.2.0
-- Bump nock from 12.0.3 to 13.5.6 
+- Bump nock from 12.0.3 to 13.5.6
 - Bump brace-expansion from 1.1.11 to 1.1.12
 - Bump @testing-library/user-event from 14.5.2 to 14.6.1
 
 ## Improved
+
 - Replace webpack with esbuild
 
 ## [1.5.11] - 2025-09-25
+
 ## Updated
+
 - Bump ts-loader from 9.4.4 to 9.5.4
+
 ## Improved
+
 - added method decorator logging
 
 ## [1.5.10] - 2025-08-11
+
 ## Updated
+
 - bumped jsdom from ^16.2.1 to jsdom 26.1.0
 - bumped axios from ^1.6.4 to 1.11.0
 
 ## [1.5.9] - 2025-07-09
+
 ## Changed
+
 - VerifyExistingCard component will now always perform 3DS action. Previously, the VerifyExistingCard would only check if the card had been previously tokenized, unless sca_enabled: true was passed as an option. This update will run SCA regardless.
 
 ## [1.5.8] – 2025-05-27
+
 ### Changed
+
 - removed yarn.lock in favour of package-lock.json
 
 ## [1.5.7] – 2025-03-31
 
 ### Changed
+
 Support for 3-D Secure 2.x PARes Status: CHALLENGED
 
 - Introduced a new PARes.CHALLENGED enumeration value to represent a "challenge" status in 3-D Secure (3DS) 2.x authentication flows. This is a required change from Cybersouce
   as it will now explicitly handle challenged events. For more information: https://developer.cybersource.com/library/documentation/dev_guides/Payer_Authentication_SCMP_API/html/Topics/Response_FieldsTable23Response_Fields_Field_NameDescriptionReturned_ByData_Type_Lengthauthorizatio-6wc.htm
 
-
 ### Fixed
-- Pass through economic commerce indicator: https://developer.cybersource.com/docs/cybs/en-us/payments/developer/vital/sa/payments/payments-processing-pa-process-intro/payments-processing-pa-eci.html
 
+- Pass through economic commerce indicator: https://developer.cybersource.com/docs/cybs/en-us/payments/developer/vital/sa/payments/payments-processing-pa-process-intro/payments-processing-pa-eci.html
 
 ### Security
+
 - Patched routine package updates

package/README.md

@@ -7,4 +7,5 @@ A modern JavaScript SDK for integrating with [Fat Zebra](https://docs.fatzebra.c
 ```bash
 npm install @fat-zebra/sdk
 # or
-yarn add @fat-zebra/sdk
+yarn add @fat-zebra/sdk
+```

package/dist/react/logging.d.ts

@@ -1,5 +1,5 @@
 import { Environment } from "../shared/env";
-import type { TokenizeCardResponse, PaymentIntent } from "../shared/types";
+import type { TokenizeCardResponse } from "../shared/types";
 type UseFatZebraLogMeta = {
     environment: Environment;
     reference: string;
@@ -8,6 +8,4 @@ type UseFatZebraLogMeta = {
 };
 declare const logUseFatZebra: (args_0: UseFatZebraLogMeta) => UseFatZebraLogMeta;
 declare const logReportTokenizeCardResponse: (args_0: TokenizeCardResponse) => void;
-declare const logReportThreeDSecureFetched: (data: boolean, paymentIntent?: PaymentIntent) => void;
-declare const logReportRequestThreedsEnabledTimeout: (paymentIntent?: PaymentIntent) => void;
-export { logUseFatZebra, logReportTokenizeCardResponse, logReportThreeDSecureFetched, logReportRequestThreedsEnabledTimeout, };
+export { logUseFatZebra, logReportTokenizeCardResponse, };

package/dist/react/logging.js

@@ -18,19 +18,4 @@ const logReportTokenizeCardResponse = instrumentFunction("reportTokenizeCardResp
     mapArgs: ([data]) => ({ token: data.token, bin: data.bin }),
     className: "useMessage",
 });
-const logReportThreeDSecureFetched = instrumentFunction("reportThreeDSecureFetched", (data) => {
-    console.log("three_d_secure fetched", data);
-}, {
-    mapArgs: ([data, paymentIntent]) => ({
-        data,
-        payment_intent: paymentIntent,
-    }),
-    className: "useMessage",
-});
-const logReportRequestThreedsEnabledTimeout = instrumentFunction("reportRequestThreedsEnabledTimeout", () => {
-    console.log("3DS enabled check timed out");
-}, {
-    mapArgs: ([paymentIntent]) => ({ payment_intent: paymentIntent }),
-    className: "useMessage",
-});
-export { logUseFatZebra, logReportTokenizeCardResponse, logReportThreeDSecureFetched, logReportRequestThreedsEnabledTimeout, };
+export { logUseFatZebra, logReportTokenizeCardResponse, };

package/dist/react/useFatZebra.js

@@ -1,8 +1,5 @@
-import { useEffect, useMemo } from "react";
-import * as FatZebra from "../shared/types";
+import { useEffect } from "react";
 import { generatePaymentURL } from "./paymentUrl";
-import Sca from "../sca";
-import GatewayClient from "../shared/api-gateway-client";
 import { generateVerifyURL } from "./verifyUrl";
 import useMessage from "./useMessage";
 import { configureLogger } from "../logging/instrument";
@@ -10,19 +7,10 @@ import env from "../shared/env";
 import { logUseFatZebra } from "./logging";
 const useFatZebra = ({ config, handlers, cardToken }) => {
     const { options, accessToken, paymentIntent, username } = config;
-    const sca = useMemo(() => {
-        const gatewayClient = new GatewayClient({ accessToken, username, environment: config.environment });
-        const successCallback = handlers[FatZebra.PublicEvent.SCA_SUCCESS];
-        const failureCallback = handlers[FatZebra.PublicEvent.SCA_ERROR];
-        const scaObj = new Sca({ gatewayClient, successCallback, failureCallback, environment: config.environment });
-        scaObj.loadScript();
-        return scaObj;
-    }, [config, username]);
     useMessage({
         paymentIntent,
         options,
         handlers,
-        sca,
         config
     });
     useEffect(() => {

package/dist/react/useMessage.d.ts

@@ -1,11 +1,9 @@
 import * as FatZebra from "../shared/types";
-import Sca from "../sca";
 type UseMessageProps = {
     paymentIntent: FatZebra.PaymentIntent;
     handlers: FatZebra.Handlers;
     options?: FatZebra.OptionalUrlValues;
-    sca?: InstanceType<typeof Sca>;
     config?: FatZebra.PaymentConfig;
 };
-declare const useMessage: ({ paymentIntent, options, handlers, sca, config }: UseMessageProps) => void;
+declare const useMessage: ({ paymentIntent, options, handlers, config }: UseMessageProps) => void;
 export default useMessage;

package/dist/react/useMessage.js

@@ -15,13 +15,10 @@ import env, { Environment } from "../shared/env";
 import { PostMessageClient } from "../shared/post-message-client";
 import { BridgeEvent } from "../shared/types";
 import { setFlowId } from '../logging/logger-context';
-import { LocalStorageAccessTokenKey } from '../shared/constants';
-import { logReportRequestThreedsEnabledTimeout, logReportThreeDSecureFetched, logReportTokenizeCardResponse } from './logging';
-const useMessage = ({ paymentIntent, options, handlers, sca, config }) => {
-    const isThreeDSecureEnabled = useRef(false);
+import { logReportTokenizeCardResponse } from './logging';
+const useMessage = ({ paymentIntent, options, handlers, config }) => {
     const threeDSecureRef = useRef(null);
     const headlessRef = useRef(null);
-    const initAuthClientRef = useRef(null);
     const listenersClientRef = useRef(null);
     // defaults to a resolved promise so handleTokenizeCardResponse doesn't hang if initAuth never runs (no config)
     const authReadyRef = useRef(Promise.resolve());
@@ -56,7 +53,7 @@ const useMessage = ({ paymentIntent, options, handlers, sca, config }) => {
         });
         if (options && options.sca_enabled) {
             yield authReadyRef.current;
-            if (threeDSecureRef.current && isThreeDSecureEnabled.current && config) {
+            if (threeDSecureRef.current) {
                 const iframe = document.querySelector('[name="renderIframe"]');
                 const flowId = crypto.randomUUID();
                 setFlowId(flowId);
@@ -70,9 +67,6 @@ const useMessage = ({ paymentIntent, options, handlers, sca, config }) => {
                     flowId
                 });
             }
-            else if (sca) {
-                yield sca.run({ paymentIntent, bin: data.bin, cardToken: data.token });
-            }
         }
     });
     const messageHandler = (event) => __awaiter(void 0, void 0, void 0, function* () {
@@ -107,58 +101,21 @@ const useMessage = ({ paymentIntent, options, handlers, sca, config }) => {
         const { el, isExisting } = bridge.load2(env[config.environment].bridgeUrl);
         headlessRef.current = el;
         const initAuth = () => {
-            const postMessageClient = new PostMessageClient({
+            const threeDS = new ThreeDSecure({
+                successCallback,
+                failureCallback,
+                bridge: el,
+                environment: config.environment,
+                accessToken: config.accessToken,
+            });
+            threeDSecureRef.current = threeDS;
+            const listenersClient = new PostMessageClient({
                 channel: 'sca',
                 target: el,
                 environment: config.environment,
             });
-            initAuthClientRef.current = postMessageClient;
-            let resolved = false;
-            let resolveAuthReady;
-            authReadyRef.current = new Promise((resolve) => { resolveAuthReady = resolve; });
-            postMessageClient.setEventListeners({
-                [BridgeEvent.THREE_D_SECURE_ENABLED]: (data) => {
-                    const enabled = typeof data === 'boolean' ? data : false;
-                    if (!resolved) {
-                        logReportThreeDSecureFetched(enabled, paymentIntent);
-                        resolved = true;
-                        isThreeDSecureEnabled.current = enabled;
-                        resolveAuthReady();
-                        if (enabled) {
-                            const threeDS = new ThreeDSecure({
-                                successCallback,
-                                failureCallback,
-                                bridge: el,
-                                environment: config.environment,
-                            });
-                            threeDSecureRef.current = threeDS;
-                            const listenersClient = new PostMessageClient({
-                                channel: 'sca',
-                                target: el,
-                                environment: config.environment,
-                            });
-                            listenersClient.setEventListeners(threeDS.messageHandlers());
-                            listenersClientRef.current = listenersClient;
-                        }
-                    }
-                },
-            }, { once: true });
-            const message = {
-                channel: 'sca',
-                subject: 'fzi.is-enabled-three-d-secure-req',
-                data: {
-                    merchant: config.username,
-                    access_token: window.localStorage.getItem(LocalStorageAccessTokenKey),
-                },
-            };
-            postMessageClient.send(message);
-            window.setTimeout(() => {
-                if (!resolved) {
-                    logReportRequestThreedsEnabledTimeout(paymentIntent);
-                    resolved = true;
-                    resolveAuthReady();
-                }
-            }, 500);
+            listenersClient.setEventListeners(threeDS.messageHandlers());
+            listenersClientRef.current = listenersClient;
         };
         if (isExisting) {
             initAuth();
@@ -179,10 +136,9 @@ const useMessage = ({ paymentIntent, options, handlers, sca, config }) => {
             };
         }
         return () => {
-            var _a, _b;
+            var _a;
             el.removeEventListener('load', initAuth);
-            (_a = initAuthClientRef.current) === null || _a === void 0 ? void 0 : _a.removeEventListeners();
-            (_b = listenersClientRef.current) === null || _b === void 0 ? void 0 : _b.removeEventListeners();
+            (_a = listenersClientRef.current) === null || _a === void 0 ? void 0 : _a.removeEventListeners();
         };
     }, []);
     useEffect(() => {

package/dist/three_d_secure/index.d.ts

@@ -8,6 +8,7 @@ interface ThreeDSecureConfig {
     environment?: Environment;
     bridge: HTMLIFrameElement;
     iframe?: HTMLIFrameElement;
+    accessToken?: string;
 }
 interface ThreeDSecureRunProps {
     paymentIntent: PaymentIntent;
@@ -35,7 +36,9 @@ declare class ThreeDSecure {
     private iframe?;
     private deviceProfileReadyHandler;
     private flowId;
-    constructor({ successCallback, failureCallback, environment, bridge }: ThreeDSecureConfig);
+    private accessToken;
+    constructor({ successCallback, failureCallback, environment, bridge, accessToken }: ThreeDSecureConfig);
+    private getAccessToken;
     run({ paymentIntent, cardToken, merchantUsername, challengeWindowSize, test, tokenizeOnly, iframe, flowId }: ThreeDSecureRunProps): void;
     setupResponse(data: DeviceDataCollectionMessage): void;
     messageHandlers(): {

package/dist/three_d_secure/index.js

@@ -19,15 +19,21 @@ import { ChallengeWindowSize } from "../sca/types";
 import * as util from "../shared/util";
 import { setFlowId } from "../logging/logger-context";
 class ThreeDSecure {
-    constructor({ successCallback, failureCallback, environment, bridge }) {
+    constructor({ successCallback, failureCallback, environment, bridge, accessToken }) {
         this.tokenizeOnly = false;
         this.deviceProfileReadyHandler = null;
+        this.accessToken = null;
         this.headlessBridge = bridge;
         this.environment = environment;
         this.successCallback = successCallback;
         this.failureCallback = failureCallback;
+        this.accessToken = accessToken !== null && accessToken !== void 0 ? accessToken : null;
         DeviceDataCollection.listenDataCollectionResponse(environment);
     }
+    getAccessToken() {
+        var _a;
+        return (_a = this.accessToken) !== null && _a !== void 0 ? _a : window.localStorage.getItem(LocalStorageAccessTokenKey);
+    }
     run({ paymentIntent, cardToken, merchantUsername, challengeWindowSize, test, tokenizeOnly, iframe, flowId }) {
         console.log('Running 3DS (ThreeDSecure)');
         this.flowId = flowId;
@@ -102,7 +108,7 @@ class ThreeDSecure {
             subject: BridgeEvent.SETUP_THREE_D_SECURE_REQUEST,
             data: {
                 flow_id: this.flowId,
-                access_token: window.localStorage.getItem(LocalStorageAccessTokenKey),
+                access_token: this.getAccessToken(),
                 reference: this.paymentIntent.payment.reference,
                 amount: this.paymentIntent.payment.amount,
                 currency: this.paymentIntent.payment.currency,
@@ -116,7 +122,7 @@ class ThreeDSecure {
         const message = {
             channel: 'sca',
             subject: BridgeEvent.ENROL_THREE_D_SECURE_REQUEST,
-            data: Object.assign(Object.assign(Object.assign({ flow_id: this.flowId, access_token: window.localStorage.getItem(LocalStorageAccessTokenKey), merchant_username: merchantUsername, card_token: cardToken }, paymentIntent.payment), { verification: paymentIntent.verification, reference_id: cybersourceReferenceId, return_url: `${env[this.environment].returnCybersourceUrl}?flow_id=${this.flowId}`, acs_window_size: (_a = this.challengeWindowSize) !== null && _a !== void 0 ? _a : ChallengeWindowSize.SIZE_500X600, device_channel: "BROWSER" }), snakeCaseKeys(DeviceDataCollection.collectDeviceData()))
+            data: Object.assign(Object.assign(Object.assign({ flow_id: this.flowId, access_token: this.getAccessToken(), merchant_username: merchantUsername, card_token: cardToken }, paymentIntent.payment), { verification: paymentIntent.verification, reference_id: cybersourceReferenceId, return_url: `${env[this.environment].returnCybersourceUrl}?flow_id=${this.flowId}`, acs_window_size: (_a = this.challengeWindowSize) !== null && _a !== void 0 ? _a : ChallengeWindowSize.SIZE_500X600, device_channel: "BROWSER" }), snakeCaseKeys(DeviceDataCollection.collectDeviceData()))
         };
         this.headlessBridge.contentWindow.postMessage(message, '*');
     }
@@ -151,7 +157,7 @@ class ThreeDSecure {
         const message = {
             channel: 'sca',
             subject: BridgeEvent.VALIDATE_THREE_D_SECURE_REQUEST,
-            data: Object.assign(Object.assign({ flow_id: this.flowId, access_token: window.localStorage.getItem(LocalStorageAccessTokenKey), merchant_username: this.merchantUsername, card_token: data.cardToken }, this.paymentIntent.payment), { authentication_transaction_id: data.transactionId })
+            data: Object.assign(Object.assign({ flow_id: this.flowId, access_token: this.getAccessToken(), merchant_username: this.merchantUsername, card_token: data.cardToken }, this.paymentIntent.payment), { authentication_transaction_id: data.transactionId })
         };
         this.headlessBridge.contentWindow.postMessage(message, '*');
     }
@@ -179,7 +185,7 @@ class ThreeDSecure {
             channel: 'sca',
             subject: BridgeEvent.CREATE_PAYMENT_REQUEST,
             data: {
-                access_token: window.localStorage.getItem(LocalStorageAccessTokenKey),
+                access_token: this.getAccessToken(),
                 amount: this.paymentIntent.payment.amount,
                 card_token: this.cardToken,
                 currency: this.paymentIntent.payment.currency,

package/dist/version.js

@@ -1,5 +1,6 @@
+/*! fatzebra-sdk-commit: 5bc4f3388b7a97acd62478a9bfdfa340a80c3847 */
 export const version = '1.5.9';
 // Placeholder replaced at build time by .github/scripts/stamp-version.js with the
 // deployed commit hash (`git rev-parse HEAD`). Stays as the placeholder for builds
 // that don't run the stamp step (e.g. local/package builds).
-export const commitHash = '__SDK_COMMIT_HASH__';
+export const commitHash = '5bc4f3388b7a97acd62478a9bfdfa340a80c3847';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fat-zebra/sdk",
-  "version": "2.0.8-beta.3",
+  "version": "2.1.0-beta.3",
   "description": "",
   "main": "index.js",
   "scripts": {

package/README.dev.md

@@ -1,157 +0,0 @@
-# FatZebra-JS
-
-**fatzebra.js** (a.k.a JS SDK)is an agent through which various FZ payment functionalies are made available to merchants.
-
-
-## Architecture Overview
-
-![Alt text](./diagrams/sdk_architecture.png)
-
-### API Gateway
-
-JS SDk communicates to various FZ backend services from merchant websites's frontend. A valid `access token` needs to be provided to the SDK during initialisation. This grants temporary access to selected services such as Gateway and PayNow. See Obtain Access Token for details
-
-The only FZ backend system that the SDK directly interacts with is the API Gateway (AWS API Gateway). Other backend services are hidden behind the API Gateway.
-
-### Cross-Frame Communications
-
-One of the functionalities provided by the SDK is to load the Hosted Payments Page (HPP) into merchant webpage so that customers can enter their credit card details and make a purchase subsequently. Upon calling the `renderPaymentsPage()` method, the SDK does the following things in order
-
-* Create an `<iframe>` DOM element and attach it to the `<div>` specified by the merchant.
-* Load the HPP into `<iframe>`
-* Upon HPP is successfully loaded, the SDK registers a number of event listeners to listen to events coming from the child frame (HPP).
-* Using the combination of the event listeners above as well as the SDK's event registration method `.on()`, events from the child frame can be bubbled up to the merchant page context.
-
-
-## Development Environment Setup
-
-### NPM install
-Install dependencies
-
-```bash
-$ npm install
-```
-
-### Start PayNow
-
-```bash
-$ bundle exec rails -p 3000
-```
-
-Go to .env.local, ensure PAYNOW_BASE_URL and PAYNOW_BRIDGE_URL have the desired hostname and port number.
-
-Upon receiving a request from the SDK, PayNow first extracts the access token from the request header, decodes it, andloads the merchant using the username extracted from the token. Please also ensure that a corresponding merchant record is available in FatZebra Core DB. It must have the same merchant username as the one used for generating the access token previously.
-
-
-### Start API Gateway
-**Skip this section if the SDK workflow you are dealing does not involve multiple FZ backend services.**
-
-> coming soon...
-
-## ApplePay
-### Ngrok tunnelling
-
-The setup above would not give us access to Apple Pay's functionalities just yet as they are only available to merchants who have gone through Apple Pay onboarding process, e.g. registering merchant website. FZ has already registered https://fzapplepay.ngrok.io with Apple and this should be used for development.
-
-Tunnel PayNow via https://fz-applepay-child.ngrok.io
-
-```bash
-$ ngrok http 4000 -subdomain=fz-applepay-child
-```
-
-Tunnel Merchant JS via https://fzapplepay.ngrok.io
-
-```bash
-ngrok http -subdomain fzapplepay  -host-header="localhost:8080" 8080
-```
-
-_Remember to specify host header, otherwise webpack-dev-server will complain._
-
-### Visit tunnelled link
-
-Visit https://fzapplepay.ngrok.io in Safari. That's all!
-
-Webpack-dev-server supports hot reloading, meaning that code changes are reflected on the web page without restarting the server.
-
-## Build Javascript
-
-There are two npm build scripts in `package.json` for building javascript files.
-
-| Command | Output | Description |
-|---------|--------|-------------|
-| npm run build:local  | dist/local/fatzebra.js |  Used for local dev only. Not saved in S3. |
-| npm run build:staging  | dist/staging/fatzebra.js | Used for E2E testing on staging. Saved in S3. Bundle is NOT minified nor uglified. |
-| npm run build:sandbox  | dist/sandbox/fatzebra.js | Saved in S3. Bundle is minified and uglified. |
-| npm run build:production | dist/production/fatzebra.js | Saved in S3. Bundle is minified and uglified. |
-
-## Deployment Pipeline
-
-The JS SDK gets built and delpoyed via github actions https://github.com/fatzebra/fatzebra-js/actions. The pipeline is defined in `.github/workflows/ci.yml`
-
-The deployed SDKs are available from the following URLs.
-
-* Test: https://cdn.pmnts-staging.io/sdk/v1/fatzebra.js
-* Sandbox: https://cdn.pmnts-sandbox.io/sdk/v1/fatzebra.js
-* Production: https://cdn.pmnts.io/sdk/v1/fatzebra.js
-
-
-## Release Management
-
-### NPM
-
-Releases are based on tags. There are two types of releases:
-    -   Production
-    -   Beta
-
-To perform a production release:
-
-```shell
-git tag -a v1.5.10 -m "Production Release: 1.5.10"
-git push origin v1.5.10
-```
-
-**NOTE:** Production releases will only work when on the `main` branch
-
-To perform a beta release
-
-```shell
-git tag -a v1.5.10-beta.0 -m "Beta: 1.5.10-beta.0"
-git push origin v1.5.10-beta.0
-```
-
-### CDN
-
-## Staging
-
-Staging is released automatically for each branch (on push)
-
-## Sandbox
-
-Sandbox deployment will trigger when pushing through a tag with beta in it on the `main` branch.
-
-Running this on main will trigger sandbox deployment (as well as npm beta release):
-
-```shell
-git tag -a v1.5.10-beta.0 -m "Beta: 1.5.10-beta.0"
-git push origin v1.5.10-beta.0
-```
-
-Additionally, the pipeline will trigger a cypress integration spec on sandbox which will run here: https://github.com/fatzebra/gazelle/actions
-Ensure this pipeline is green before deploying to production and then post a link of the outcome
-
-## Production
-
-Production deployment will _ONLY_ trigger on the main branch and when pushing through a tag WITHOUT beta in it.
-
-Running this on main will trigger production deployment:
-
-```shell
-git tag -a v1.5.10 -m "Beta: 1.5.10"
-git push origin v1.5.10
-```
-
-## Rollback management
-
-The pipeline will upload a version to override the existing deployment, but also a version of the build to a folder in s3.
-
-