@paydock/client-sdk 1.142.0 → 1.144.0-beta

package/bundles/index.mjs

@@ -1192,7 +1192,7 @@ SDK.headerKeys = Object.freeze({
   version: 'x-sdk-version',
   type: 'x-sdk-type'
 });
-SDK._version = 'v1.142.0';
+SDK._version = 'v1.144.0-beta';
 
 function isFunction(value) {
     return typeof value === 'function';
@@ -4802,127 +4802,162 @@ var Api = /*#__PURE__*/function (_ApiBase) {
   }]);
 }(ApiBase);
 
-var Url = /*#__PURE__*/function () {
-  function Url() {
-    _classCallCheck(this, Url);
+var WALLET_CAPTURE_LINK = '/v1/charges/wallet/capture';
+var WALLET_CALLBACK_LINK = '/v1/charges/wallet/callback';
+var STANDALONE_3DS_PROCESS_LINK = '/v1/charges/standalone-3ds/process';
+var STANDALONE_3DS_HANDLE_LINK = '/v1/charges/standalone-3ds/handle';
+var ApiChargeInternal = /*#__PURE__*/function () {
+  function ApiChargeInternal(api) {
+    _classCallCheck(this, ApiChargeInternal);
+    this.api = api;
   }
-  return _createClass(Url, null, [{
-    key: "extendSearchParams",
-    value: function extendSearchParams(uri, key, val) {
-      return uri.replace(new RegExp("([?&]" + key + "(?=[=&#]|$)[^#&]*|(?=#|$))"), "&" + key + "=" + encodeURIComponent(val)).replace(/^([^?&]+)&/, "$1?");
+  return _createClass(ApiChargeInternal, [{
+    key: "walletCapture",
+    value: function walletCapture(payload) {
+      return this.api.getClientPromise('POST', WALLET_CAPTURE_LINK).send(payload);
     }
   }, {
-    key: "serialize",
-    value: function serialize(params) {
-      return Object.keys(params).map(function (key) {
-        return encodeURIComponent(key) + '=' + encodeURIComponent(params[key]);
-      }).join('&');
+    key: "walletCallback",
+    value: function walletCallback(payload) {
+      return this.api.getClientPromise('POST', WALLET_CALLBACK_LINK).send(payload);
+    }
+  }, {
+    key: "standalone3dsProcess",
+    value: function standalone3dsProcess(payload) {
+      return this.api.getClientPromise('POST', STANDALONE_3DS_PROCESS_LINK).send(payload);
+    }
+  }, {
+    key: "standalone3dsHandle",
+    value: function standalone3dsHandle() {
+      return this.api.getClientPromise('GET', STANDALONE_3DS_HANDLE_LINK).send(undefined);
     }
   }]);
 }();
 
-var Uuid = /*#__PURE__*/function () {
-  function Uuid() {
-    _classCallCheck(this, Uuid);
+var CALLBACK_LINK = '/v1/checkouts/callback';
+var INSTRUCTION_LINK = '/v1/checkouts/instruction';
+var STATUS_LINK = '/v1/checkouts';
+var ApiCheckoutInternal = /*#__PURE__*/function () {
+  function ApiCheckoutInternal(api) {
+    _classCallCheck(this, ApiCheckoutInternal);
+    this.api = api;
+    this.getInstructionLink = function () {
+      return "".concat(INSTRUCTION_LINK, "?time=").concat(Date.now());
+    };
   }
-  return _createClass(Uuid, null, [{
-    key: "generate",
-    value: function generate() {
-      if (typeof window !== "undefined" && typeof window.crypto !== "undefined" && typeof window.crypto.getRandomValues !== "undefined") {
-        var buf = new Uint16Array(8);
-        window.crypto.getRandomValues(buf);
-        return this.hash(buf[0]) + this.hash(buf[1]) + "-" + this.hash(buf[2]) + "-" + this.hash(buf[3]) + "-" + this.hash(buf[4]) + "-" + this.hash(buf[5]) + this.hash(buf[6]) + this.hash(buf[7]);
-      } else {
-        return this.random() + this.random() + "-" + this.random() + "-" + this.random() + "-" + this.random() + "-" + this.random() + this.random() + this.random();
-      }
+  return _createClass(ApiCheckoutInternal, [{
+    key: "instructions",
+    value: function instructions() {
+      return this.api.requestObservable('GET', this.getInstructionLink(), {});
     }
   }, {
-    key: "hash",
-    value: function hash(number) {
-      var hash = number.toString(16);
-      while (hash.length < 4) {
-        hash = "0" + hash;
-      }
-      return hash;
+    key: "callback",
+    value: function callback(payload) {
+      return this.api.getClientPromise('POST', CALLBACK_LINK).send(payload);
     }
   }, {
-    key: "random",
-    value: function random() {
-      return Math.floor((1 + Math.random()) * 0x10000).toString(16).substring(1);
+    key: "status",
+    value: function status(id) {
+      return this.api.getClientPromise('GET', "".concat(STATUS_LINK, "/").concat(id)).send('');
     }
   }]);
 }();
 
-var WIDGET_LINK = '/remote-action';
-var VAULT_DISPLAY_WIDGET_LINK = '/vault-display';
-var PAYMENT_SOURCE_LINK = '/payment-sources';
-var SECURE_3D = '/3ds/webhook';
-var FLYPAY_LINK = '/wallet/flypay';
-var FLYPAY_LOGO_LINK = '/images/coles-pay-logo.png';
-var MESSAGE_WIDGET_LINK = '/message-widget';
-var MASTERCARD_SRC = '/secure-remote-commerce/mastercard';
-var Link = /*#__PURE__*/function () {
-  function Link(linkResource) {
-    _classCallCheck(this, Link);
-    this.params = {};
-    this.widgetId = Uuid.generate();
-    this.linkResource = linkResource;
-    this.env = new Env(WIDGET_URL);
-    this.setParams({
-      widget_id: this.widgetId
-    });
+var GET_WALLET_CONFIG = '/v1/gateways/:gateway_id/wallet-config';
+var ApiGatewayInternal = /*#__PURE__*/function () {
+  function ApiGatewayInternal(api) {
+    _classCallCheck(this, ApiGatewayInternal);
+    this.api = api;
   }
-  return _createClass(Link, [{
-    key: "getNetUrl",
-    value: function getNetUrl() {
-      return this.env.getConf().url + this.linkResource;
+  return _createClass(ApiGatewayInternal, [{
+    key: "getWalletConfig",
+    value: function getWalletConfig(gateway_id) {
+      var url = GET_WALLET_CONFIG.replace(':gateway_id', gateway_id);
+      return this.api.getClientPromise('GET', url).send(undefined);
     }
-  }, {
-    key: "getUrl",
-    value: function getUrl() {
-      var url = this.getNetUrl();
-      var params = this.getParams();
-      for (var key in params) {
-        if (params.hasOwnProperty(key)) url = Url.extendSearchParams(url, key, params[key]);
-      }
-      return url;
+  }]);
+}();
+
+var CREATE_OTT = '/v1/payment_sources/tokens';
+var CREATE_SESSION = '/v1/payment_sources/payment-session';
+var ApiPaymentSourceInternal = /*#__PURE__*/function () {
+  function ApiPaymentSourceInternal(api) {
+    _classCallCheck(this, ApiPaymentSourceInternal);
+    this.api = api;
+  }
+  return _createClass(ApiPaymentSourceInternal, [{
+    key: "createOTT",
+    value: function createOTT(payload) {
+      return this.api.getClientPromise('POST', CREATE_OTT).send(payload);
     }
   }, {
-    key: "setParams",
-    value: function setParams(params) {
-      this.params = _extends({}, this.params, params);
+    key: "createSession",
+    value: function createSession(payload) {
+      return this.api.getClientPromise('POST', CREATE_SESSION).send(payload);
     }
-  }, {
-    key: "concatParams",
-    value: function concatParams(params) {
-      for (var key in params) {
-        if (!params.hasOwnProperty(key) || !params[key].length) continue;
-        if (typeof this.params[key] !== 'string') this.params[key] = '';
-        if (this.params[key].length) this.params[key] += ',' + params[key];else this.params[key] += params[key];
-      }
+  }]);
+}();
+
+var GET_CONFIG = '/v1/services/:service_id/config';
+var ApiServiceInternal = /*#__PURE__*/function () {
+  function ApiServiceInternal(api) {
+    _classCallCheck(this, ApiServiceInternal);
+    this.api = api;
+  }
+  return _createClass(ApiServiceInternal, [{
+    key: "getConfig",
+    value: function getConfig(service_id) {
+      var url = GET_CONFIG.replace(':service_id', service_id);
+      return this.api.getClientPromise('GET', url).send(undefined);
+    }
+  }]);
+}();
+var SERVICE_TYPES;
+(function (SERVICE_TYPES) {
+  SERVICE_TYPES["ACCERTIFY"] = "Accertify";
+  SERVICE_TYPES["BOOKING"] = "Booking";
+  SERVICE_TYPES["GPAYMENTS"] = "GPayments";
+  SERVICE_TYPES["CLICK_TO_PAY"] = "ClickToPay";
+  SERVICE_TYPES["MASTERCARD_NT"] = "MastercardSCOF";
+  SERVICE_TYPES["VISA_NT"] = "VisaVTS";
+  SERVICE_TYPES["FORTER"] = "Forter";
+  SERVICE_TYPES["APPLE_PAY"] = "ApplePay";
+  SERVICE_TYPES["GOOGLE_PAY"] = "GooglePay";
+})(SERVICE_TYPES || (SERVICE_TYPES = {}));
+
+var ApiInternal = /*#__PURE__*/function (_ApiBase) {
+  function ApiInternal() {
+    _classCallCheck(this, ApiInternal);
+    return _callSuper(this, ApiInternal, arguments);
+  }
+  _inherits(ApiInternal, _ApiBase);
+  return _createClass(ApiInternal, [{
+    key: "charge",
+    value: function charge() {
+      return new ApiChargeInternal(this);
     }
   }, {
-    key: "getParams",
-    value: function getParams() {
-      return this.params;
+    key: "service",
+    value: function service() {
+      return new ApiServiceInternal(this);
     }
   }, {
-    key: "setEnv",
-    value: function setEnv(env, alias) {
-      this.env.setEnv(env, alias);
+    key: "checkout",
+    value: function checkout() {
+      return new ApiCheckoutInternal(this);
     }
   }, {
-    key: "getEnv",
-    value: function getEnv() {
-      return this.env.getEnv();
+    key: "gateway",
+    value: function gateway() {
+      return new ApiGatewayInternal(this);
     }
   }, {
-    key: "getBaseUrl",
-    value: function getBaseUrl() {
-      return this.env.getConf().url;
+    key: "paymentSource",
+    value: function paymentSource() {
+      return new ApiPaymentSourceInternal(this);
     }
   }]);
-}();
+}(ApiBase);
 
 var IFrame = /*#__PURE__*/function () {
   function IFrame(container) {
@@ -5119,10 +5154,10 @@ var IFrameEvent = /*#__PURE__*/function () {
 }();
 
 var hiddenStyle = {
-  visibility: "hidden",
-  border: "0",
-  width: "0",
-  height: "0"
+  visibility: 'hidden',
+  border: '0',
+  width: '0',
+  height: '0'
 };
 var PROCESS_STANDALONE_3DS_STATUS;
 (function (PROCESS_STANDALONE_3DS_STATUS) {
@@ -5144,14 +5179,30 @@ var IFRAME_STATUS;
   IFRAME_STATUS["TIMEOUT"] = "AuthTimedOut";
   IFRAME_STATUS["INVALID"] = "invalid_event";
 })(IFRAME_STATUS || (IFRAME_STATUS = {}));
+/**
+ * Event name constants emitted during the Standalone 3DS (GPayments) flow.
+ * Used internally by `GPaymentsService` and re-exported publicly as `CANVAS_3DS_EVENT`.
+ */
 var GPAYMENTS_EVENT = {
+  /** Authentication succeeded. Payload: `Canvas3dsAuthPayload`. */
   AUTH_SUCCESS: 'chargeAuthSuccess',
+  /** Authentication failed — covers issuer rejection, iframe timeout (`AuthTimedOut`), and invalid-event outcomes. Payload: `Canvas3dsAuthPayload`. */
   AUTH_ERROR: 'chargeAuthReject',
+  /** Decoupled authentication — issuer will authenticate out-of-band. Payload: `Canvas3dsAuthPayload`. */
   DECOUPLED: 'chargeAuthDecoupled',
+  /** Challenge required — issuer demands user interaction. Payload: `Canvas3dsAuthPayload`. */
   CHALLENGE: 'chargeAuthChallenge',
+  /** Informational signal emitted by the GPayments flow. Internal — not part of the public typed surface. */
   INFO: 'chargeAuthInfo',
+  /** Error during the flow (network, parsing, etc.). Payload: `Canvas3dsErrorPayload`. */
   ERROR: 'error'
 };
+/**
+ * Public alias for GPAYMENTS_EVENT. Same object reference — no behavioral change.
+ * Prefer `CANVAS_3DS_EVENT` in public-facing code; `GPAYMENTS_EVENT` remains for
+ * backwards-compatible internal usage.
+ */
+var CANVAS_3DS_EVENT = GPAYMENTS_EVENT;
 var GPaymentsService = /*#__PURE__*/function () {
   function GPaymentsService(container, api, eventEmitter) {
     _classCallCheck(this, GPaymentsService);
@@ -5179,20 +5230,22 @@ var GPaymentsService = /*#__PURE__*/function () {
     value: function initializeIFrames(initializationUrl, secondaryUrl, title) {
       var hideAuthorization = arguments.length > 3 && arguments[3] !== undefined ? arguments[3] : true;
       var container = this.container.getElement();
-      if (!container) return;
-      var divAuthorization = document.createElement("div");
-      divAuthorization.setAttribute("id", "paydock_authorization_iframe");
+      if (!container) {
+        return;
+      }
+      var divAuthorization = document.createElement('div');
+      divAuthorization.setAttribute('id', 'paydock_authorization_iframe');
       container.appendChild(divAuthorization);
-      this.browserAndChallengeContainer = new Container("#paydock_authorization_iframe");
+      this.browserAndChallengeContainer = new Container('#paydock_authorization_iframe');
       this.iFrameAuthorization = new IFrame(this.browserAndChallengeContainer);
       this.iFrameAuthorization.load(initializationUrl, {
         title: title
       });
       if (secondaryUrl) {
-        var divSecondaryURL = document.createElement("div");
-        divSecondaryURL.setAttribute("id", "paydock_secondary_iframe");
+        var divSecondaryURL = document.createElement('div');
+        divSecondaryURL.setAttribute('id', 'paydock_secondary_iframe');
         container.appendChild(divSecondaryURL);
-        this.monitoringContainer = new Container("#paydock_secondary_iframe");
+        this.monitoringContainer = new Container('#paydock_secondary_iframe');
         this.iFrameSecondaryUrl = new IFrame(this.monitoringContainer);
         this.iFrameSecondaryUrl.load(secondaryUrl, {
           title: title
@@ -5208,8 +5261,12 @@ var GPaymentsService = /*#__PURE__*/function () {
       var hideAuthorization = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : true;
       var _a;
       for (var prop in hiddenStyle) {
-        if (!hiddenStyle.hasOwnProperty(prop)) continue;
-        if (hideAuthorization) this.iFrameAuthorization.setStyle(prop, hiddenStyle[prop]);
+        if (!Object.hasOwn(hiddenStyle, prop)) {
+          continue;
+        }
+        if (hideAuthorization) {
+          this.iFrameAuthorization.setStyle(prop, hiddenStyle[prop]);
+        }
         (_a = this.iFrameSecondaryUrl) === null || _a === void 0 ? void 0 : _a.setStyle(prop, hiddenStyle[prop]);
       }
     }
@@ -5219,13 +5276,17 @@ var GPaymentsService = /*#__PURE__*/function () {
       var _this = this;
       this.iFrameEvent.on(EVENT$5.CHARGE_AUTH, widgetId, function (data) {
         if (data.status === IFRAME_STATUS.SKIPPED || data.status === IFRAME_STATUS.FINISHED) {
-          if (data.info) _this.eventEmitter.emit(GPAYMENTS_EVENT.INFO, {
-            info: data.info
-          });
+          if (data.info) {
+            _this.eventEmitter.emit(GPAYMENTS_EVENT.INFO, {
+              info: data.info
+            });
+          }
           _this.performAuthentication(data);
-        } else if (data.status === IFRAME_STATUS.TIMEOUT || data.status === IFRAME_STATUS.INVALID) _this.eventEmitter.emit(GPAYMENTS_EVENT.AUTH_ERROR, _this.parseHandleResponse({
-          status: data.status
-        }, data.charge_3ds_id));
+        } else if (data.status === IFRAME_STATUS.TIMEOUT || data.status === IFRAME_STATUS.INVALID) {
+          _this.eventEmitter.emit(GPAYMENTS_EVENT.AUTH_ERROR, _this.parseHandleResponse({
+            status: data.status
+          }, data.charge_3ds_id));
+        }
       });
       this.iFrameEvent.on(EVENT$5.CHARGE_AUTH_SUCCESS, widgetId, function (data) {
         _this.processResult(data.charge_3ds_id);
@@ -5265,13 +5326,19 @@ var GPaymentsService = /*#__PURE__*/function () {
     key: "processResult",
     value: function processResult(charge3dsId) {
       var _this2 = this;
-      if (this.resultRead) return;
+      if (this.resultRead) {
+        return;
+      }
       this.resultRead = true;
       this.api.charge().standalone3dsHandle().then(function (result) {
         var _a;
         _this2.iFrameAuthorization.remove();
         (_a = _this2.iFrameSecondaryUrl) === null || _a === void 0 ? void 0 : _a.remove();
-        if (result.status === PROCESS_STANDALONE_3DS_STATUS.SUCCESS) _this2.eventEmitter.emit(GPAYMENTS_EVENT.AUTH_SUCCESS, _this2.parseResultData(result, charge3dsId));else _this2.eventEmitter.emit(GPAYMENTS_EVENT.AUTH_ERROR, _this2.parseResultData(result, charge3dsId));
+        if (result.status === PROCESS_STANDALONE_3DS_STATUS.SUCCESS) {
+          _this2.eventEmitter.emit(GPAYMENTS_EVENT.AUTH_SUCCESS, _this2.parseResultData(result, charge3dsId));
+        } else {
+          _this2.eventEmitter.emit(GPAYMENTS_EVENT.AUTH_ERROR, _this2.parseResultData(result, charge3dsId));
+        }
       }, function (err) {
         _this2.eventEmitter.emit(GPAYMENTS_EVENT.ERROR, _this2.parseError(err, charge3dsId));
       });
@@ -5296,10 +5363,16 @@ var GPaymentsService = /*#__PURE__*/function () {
     key: "doPolling",
     value: function doPolling(url, charge3dsId) {
       var _this3 = this;
-      this.externalAPI("GET", url).then(function (data) {
-        if (!data.event || data.event === "AuthResultNotReady") setTimeout(function () {
-          _this3.doPolling(url, charge3dsId);
-        }, 2000);else if (data.event === 'AuthResultReady') _this3.processResult(charge3dsId);else throw new Error("Event not supported");
+      this.externalAPI('GET', url).then(function (data) {
+        if (!data.event || data.event === 'AuthResultNotReady') {
+          setTimeout(function () {
+            _this3.doPolling(url, charge3dsId);
+          }, 2000);
+        } else if (data.event === 'AuthResultReady') {
+          _this3.processResult(charge3dsId);
+        } else {
+          throw new Error('Event not supported');
+        }
       })["catch"](function (err) {
         return _this3.eventEmitter.emit(GPAYMENTS_EVENT.ERROR, _this3.parseError(err, charge3dsId));
       });
@@ -5316,16 +5389,24 @@ var GPaymentsService = /*#__PURE__*/function () {
         charge_3ds_id: charge_3ds_id
       }).then(function (authenticationResult) {
         var _a, _b;
-        if (authenticationResult.status === AUTHENTICATION_STATUS.SUCCESS) _this4.eventEmitter.emit(GPAYMENTS_EVENT.AUTH_SUCCESS, _this4.parseHandleResponse(authenticationResult, charge_3ds_id));else if (authenticationResult.status === AUTHENTICATION_STATUS.PENDING) {
+        if (authenticationResult.status === AUTHENTICATION_STATUS.SUCCESS) {
+          _this4.eventEmitter.emit(GPAYMENTS_EVENT.AUTH_SUCCESS, _this4.parseHandleResponse(authenticationResult, charge_3ds_id));
+        } else if (authenticationResult.status === AUTHENTICATION_STATUS.PENDING) {
           if ((_a = authenticationResult === null || authenticationResult === void 0 ? void 0 : authenticationResult.result) === null || _a === void 0 ? void 0 : _a.challenge) {
             _this4.eventEmitter.emit(GPAYMENTS_EVENT.CHALLENGE, _this4.parseHandleResponse(authenticationResult, charge_3ds_id));
             _this4.initializeIFrames(authenticationResult.result.challenge_url, undefined, 'Authentication Challenge', false);
-            if (authenticationResult.result.secondary_url) _this4.doPolling(authenticationResult.result.secondary_url, charge_3ds_id);
+            if (authenticationResult.result.secondary_url) {
+              _this4.doPolling(authenticationResult.result.secondary_url, charge_3ds_id);
+            }
           } else if ((_b = authenticationResult === null || authenticationResult === void 0 ? void 0 : authenticationResult.result) === null || _b === void 0 ? void 0 : _b.decoupled_challenge) {
             _this4.eventEmitter.emit(GPAYMENTS_EVENT.DECOUPLED, _this4.parseHandleResponse(authenticationResult, charge_3ds_id));
-            if (authenticationResult.result.secondary_url) _this4.doPolling(authenticationResult.result.secondary_url, charge_3ds_id);
+            if (authenticationResult.result.secondary_url) {
+              _this4.doPolling(authenticationResult.result.secondary_url, charge_3ds_id);
+            }
           }
-        } else return _this4.eventEmitter.emit(GPAYMENTS_EVENT.AUTH_ERROR, _this4.parseHandleResponse(authenticationResult, charge_3ds_id));
+        } else {
+          return _this4.eventEmitter.emit(GPAYMENTS_EVENT.AUTH_ERROR, _this4.parseHandleResponse(authenticationResult, charge_3ds_id));
+        }
       }, function (err) {
         _this4.eventEmitter.emit(GPAYMENTS_EVENT.ERROR, _this4.parseError(err, charge_3ds_id));
       });
@@ -5333,192 +5414,159 @@ var GPaymentsService = /*#__PURE__*/function () {
   }]);
 }();
 
-var WALLET_CAPTURE_LINK = '/v1/charges/wallet/capture';
-var WALLET_CALLBACK_LINK = '/v1/charges/wallet/callback';
-var STANDALONE_3DS_PROCESS_LINK = '/v1/charges/standalone-3ds/process';
-var STANDALONE_3DS_HANDLE_LINK = '/v1/charges/standalone-3ds/handle';
-var ApiChargeInternal = /*#__PURE__*/function () {
-  function ApiChargeInternal(api) {
-    _classCallCheck(this, ApiChargeInternal);
-    this.api = api;
+var STANDALONE_3DS_GATEWAYS = {
+  GPAYMENTS: 'GPayments'
+};
+var Standalone3dsService = /*#__PURE__*/function () {
+  function Standalone3dsService(container, eventEmitter) {
+    _classCallCheck(this, Standalone3dsService);
+    this.env = DEFAULT_ENV;
+    this.container = container;
+    this.eventEmitter = eventEmitter;
   }
-  return _createClass(ApiChargeInternal, [{
-    key: "walletCapture",
-    value: function walletCapture(payload) {
-      return this.api.getClientPromise('POST', WALLET_CAPTURE_LINK).send(payload);
-    }
-  }, {
-    key: "walletCallback",
-    value: function walletCallback(payload) {
-      return this.api.getClientPromise('POST', WALLET_CALLBACK_LINK).send(payload);
-    }
-  }, {
-    key: "standalone3dsProcess",
-    value: function standalone3dsProcess(payload) {
-      return this.api.getClientPromise('POST', STANDALONE_3DS_PROCESS_LINK).send(payload);
+  return _createClass(Standalone3dsService, [{
+    key: "load",
+    value: function load(token, options) {
+      var parsedToken = AccessToken.validateJWT(token);
+      if (!parsedToken) {
+        throw new Error('Invalid charge token');
+      }
+      var tokenData = AccessToken.extractData(parsedToken.body);
+      var api = new ApiInternal(token, API_AUTH_TYPE.TOKEN);
+      api.setEnv(this.env, this.alias);
+      switch (tokenData.service_type) {
+        case STANDALONE_3DS_GATEWAYS.GPAYMENTS:
+          new GPaymentsService(this.container, api, this.eventEmitter).load(tokenData, options.title);
+          break;
+      }
     }
   }, {
-    key: "standalone3dsHandle",
-    value: function standalone3dsHandle() {
-      return this.api.getClientPromise('GET', STANDALONE_3DS_HANDLE_LINK).send(undefined);
+    key: "setEnv",
+    value: function setEnv(env, alias) {
+      this.env = env;
+      this.alias = alias;
     }
   }]);
 }();
 
-var CALLBACK_LINK = '/v1/checkouts/callback';
-var INSTRUCTION_LINK = '/v1/checkouts/instruction';
-var STATUS_LINK = '/v1/checkouts';
-var ApiCheckoutInternal = /*#__PURE__*/function () {
-  function ApiCheckoutInternal(api) {
-    _classCallCheck(this, ApiCheckoutInternal);
-    this.api = api;
-    this.getInstructionLink = function () {
-      return "".concat(INSTRUCTION_LINK, "?time=").concat(Date.now());
-    };
+var Url = /*#__PURE__*/function () {
+  function Url() {
+    _classCallCheck(this, Url);
   }
-  return _createClass(ApiCheckoutInternal, [{
-    key: "instructions",
-    value: function instructions() {
-      return this.api.requestObservable('GET', this.getInstructionLink(), {});
-    }
-  }, {
-    key: "callback",
-    value: function callback(payload) {
-      return this.api.getClientPromise('POST', CALLBACK_LINK).send(payload);
+  return _createClass(Url, null, [{
+    key: "extendSearchParams",
+    value: function extendSearchParams(uri, key, val) {
+      return uri.replace(new RegExp("([?&]" + key + "(?=[=&#]|$)[^#&]*|(?=#|$))"), "&" + key + "=" + encodeURIComponent(val)).replace(/^([^?&]+)&/, "$1?");
     }
   }, {
-    key: "status",
-    value: function status(id) {
-      return this.api.getClientPromise('GET', "".concat(STATUS_LINK, "/").concat(id)).send('');
-    }
-  }]);
-}();
-
-var GET_WALLET_CONFIG = '/v1/gateways/:gateway_id/wallet-config';
-var ApiGatewayInternal = /*#__PURE__*/function () {
-  function ApiGatewayInternal(api) {
-    _classCallCheck(this, ApiGatewayInternal);
-    this.api = api;
-  }
-  return _createClass(ApiGatewayInternal, [{
-    key: "getWalletConfig",
-    value: function getWalletConfig(gateway_id) {
-      var url = GET_WALLET_CONFIG.replace(':gateway_id', gateway_id);
-      return this.api.getClientPromise('GET', url).send(undefined);
+    key: "serialize",
+    value: function serialize(params) {
+      return Object.keys(params).map(function (key) {
+        return encodeURIComponent(key) + '=' + encodeURIComponent(params[key]);
+      }).join('&');
     }
   }]);
 }();
 
-var CREATE_OTT = '/v1/payment_sources/tokens';
-var CREATE_SESSION = '/v1/payment_sources/payment-session';
-var ApiPaymentSourceInternal = /*#__PURE__*/function () {
-  function ApiPaymentSourceInternal(api) {
-    _classCallCheck(this, ApiPaymentSourceInternal);
-    this.api = api;
+var Uuid = /*#__PURE__*/function () {
+  function Uuid() {
+    _classCallCheck(this, Uuid);
   }
-  return _createClass(ApiPaymentSourceInternal, [{
-    key: "createOTT",
-    value: function createOTT(payload) {
-      return this.api.getClientPromise('POST', CREATE_OTT).send(payload);
+  return _createClass(Uuid, null, [{
+    key: "generate",
+    value: function generate() {
+      if (typeof window !== "undefined" && typeof window.crypto !== "undefined" && typeof window.crypto.getRandomValues !== "undefined") {
+        var buf = new Uint16Array(8);
+        window.crypto.getRandomValues(buf);
+        return this.hash(buf[0]) + this.hash(buf[1]) + "-" + this.hash(buf[2]) + "-" + this.hash(buf[3]) + "-" + this.hash(buf[4]) + "-" + this.hash(buf[5]) + this.hash(buf[6]) + this.hash(buf[7]);
+      } else {
+        return this.random() + this.random() + "-" + this.random() + "-" + this.random() + "-" + this.random() + "-" + this.random() + this.random() + this.random();
+      }
     }
   }, {
-    key: "createSession",
-    value: function createSession(payload) {
-      return this.api.getClientPromise('POST', CREATE_SESSION).send(payload);
+    key: "hash",
+    value: function hash(number) {
+      var hash = number.toString(16);
+      while (hash.length < 4) {
+        hash = "0" + hash;
+      }
+      return hash;
     }
-  }]);
-}();
-
-var GET_CONFIG = '/v1/services/:service_id/config';
-var ApiServiceInternal = /*#__PURE__*/function () {
-  function ApiServiceInternal(api) {
-    _classCallCheck(this, ApiServiceInternal);
-    this.api = api;
-  }
-  return _createClass(ApiServiceInternal, [{
-    key: "getConfig",
-    value: function getConfig(service_id) {
-      var url = GET_CONFIG.replace(':service_id', service_id);
-      return this.api.getClientPromise('GET', url).send(undefined);
+  }, {
+    key: "random",
+    value: function random() {
+      return Math.floor((1 + Math.random()) * 0x10000).toString(16).substring(1);
     }
   }]);
 }();
-var SERVICE_TYPES;
-(function (SERVICE_TYPES) {
-  SERVICE_TYPES["ACCERTIFY"] = "Accertify";
-  SERVICE_TYPES["BOOKING"] = "Booking";
-  SERVICE_TYPES["GPAYMENTS"] = "GPayments";
-  SERVICE_TYPES["CLICK_TO_PAY"] = "ClickToPay";
-  SERVICE_TYPES["MASTERCARD_NT"] = "MastercardSCOF";
-  SERVICE_TYPES["VISA_NT"] = "VisaVTS";
-  SERVICE_TYPES["FORTER"] = "Forter";
-  SERVICE_TYPES["APPLE_PAY"] = "ApplePay";
-  SERVICE_TYPES["GOOGLE_PAY"] = "GooglePay";
-})(SERVICE_TYPES || (SERVICE_TYPES = {}));
 
-var ApiInternal = /*#__PURE__*/function (_ApiBase) {
-  function ApiInternal() {
-    _classCallCheck(this, ApiInternal);
-    return _callSuper(this, ApiInternal, arguments);
+var WIDGET_LINK = '/remote-action';
+var VAULT_DISPLAY_WIDGET_LINK = '/vault-display';
+var PAYMENT_SOURCE_LINK = '/payment-sources';
+var SECURE_3D = '/3ds/webhook';
+var FLYPAY_LINK = '/wallet/flypay';
+var FLYPAY_LOGO_LINK = '/images/coles-pay-logo.png';
+var MESSAGE_WIDGET_LINK = '/message-widget';
+var MASTERCARD_SRC = '/secure-remote-commerce/mastercard';
+var Link = /*#__PURE__*/function () {
+  function Link(linkResource) {
+    _classCallCheck(this, Link);
+    this.params = {};
+    this.widgetId = Uuid.generate();
+    this.linkResource = linkResource;
+    this.env = new Env(WIDGET_URL);
+    this.setParams({
+      widget_id: this.widgetId
+    });
   }
-  _inherits(ApiInternal, _ApiBase);
-  return _createClass(ApiInternal, [{
-    key: "charge",
-    value: function charge() {
-      return new ApiChargeInternal(this);
+  return _createClass(Link, [{
+    key: "getNetUrl",
+    value: function getNetUrl() {
+      return this.env.getConf().url + this.linkResource;
     }
   }, {
-    key: "service",
-    value: function service() {
-      return new ApiServiceInternal(this);
+    key: "getUrl",
+    value: function getUrl() {
+      var url = this.getNetUrl();
+      var params = this.getParams();
+      for (var key in params) {
+        if (params.hasOwnProperty(key)) url = Url.extendSearchParams(url, key, params[key]);
+      }
+      return url;
     }
   }, {
-    key: "checkout",
-    value: function checkout() {
-      return new ApiCheckoutInternal(this);
+    key: "setParams",
+    value: function setParams(params) {
+      this.params = _extends({}, this.params, params);
     }
   }, {
-    key: "gateway",
-    value: function gateway() {
-      return new ApiGatewayInternal(this);
+    key: "concatParams",
+    value: function concatParams(params) {
+      for (var key in params) {
+        if (!params.hasOwnProperty(key) || !params[key].length) continue;
+        if (typeof this.params[key] !== 'string') this.params[key] = '';
+        if (this.params[key].length) this.params[key] += ',' + params[key];else this.params[key] += params[key];
+      }
     }
   }, {
-    key: "paymentSource",
-    value: function paymentSource() {
-      return new ApiPaymentSourceInternal(this);
-    }
-  }]);
-}(ApiBase);
-
-var STANDALONE_3DS_GATEWAYS = {
-  GPAYMENTS: "GPayments"
-};
-var Standalone3dsService = /*#__PURE__*/function () {
-  function Standalone3dsService(container, eventEmitter) {
-    _classCallCheck(this, Standalone3dsService);
-    this.env = DEFAULT_ENV;
-    this.container = container;
-    this.eventEmitter = eventEmitter;
-  }
-  return _createClass(Standalone3dsService, [{
-    key: "load",
-    value: function load(token, options) {
-      var parsedToken = AccessToken.validateJWT(token);
-      if (!parsedToken) throw new Error("Invalid charge token");
-      var tokenData = AccessToken.extractData(parsedToken.body);
-      var api = new ApiInternal(token, API_AUTH_TYPE.TOKEN);
-      api.setEnv(this.env, this.alias);
-      switch (tokenData.service_type) {
-        case STANDALONE_3DS_GATEWAYS.GPAYMENTS:
-          new GPaymentsService(this.container, api, this.eventEmitter).load(tokenData, options.title);
-          break;
-      }
+    key: "getParams",
+    value: function getParams() {
+      return this.params;
     }
   }, {
     key: "setEnv",
     value: function setEnv(env, alias) {
-      this.env = env;
-      this.alias = alias;
+      this.env.setEnv(env, alias);
+    }
+  }, {
+    key: "getEnv",
+    value: function getEnv() {
+      return this.env.getEnv();
+    }
+  }, {
+    key: "getBaseUrl",
+    value: function getBaseUrl() {
+      return this.env.getConf().url;
     }
   }]);
 }();
@@ -5558,7 +5606,7 @@ var TOKEN_FORMAT$2;
  * @param {string} CHARGE_AUTH_CHALLENGE=chargeAuthChallenge
  * @param {string} CHARGE_AUTH_INFO=chargeAuthInfo
  * @param {string} ERROR=error
-*/
+ */
 /**
  * Class Canvas3ds include method for working on html
  * @constructor
@@ -5594,13 +5642,21 @@ var Canvas3ds = /*#__PURE__*/function () {
      *
      */
     function load() {
-      if (this.token.format === TOKEN_FORMAT$2.HTML) this.iFrame.loadFromHtml(this.token.content, {
-        title: '3d secure authentication'
-      }, 'threeDSecure-iframe');else if (this.token.format === TOKEN_FORMAT$2.URL) this.iFrame.load(this.token.content, {
-        title: '3d secure authentication'
-      }, 'threeDSecure-iframe');else if (this.token.format === TOKEN_FORMAT$2.STANDALONE_3DS) this.standalone3dsService.load(this.token.content, {
-        title: '3d secure authentication'
-      });else console.error('Token contain unsupported payload');
+      if (this.token.format === TOKEN_FORMAT$2.HTML) {
+        this.iFrame.loadFromHtml(this.token.content, {
+          title: '3d secure authentication'
+        }, 'threeDSecure-iframe');
+      } else if (this.token.format === TOKEN_FORMAT$2.URL) {
+        this.iFrame.load(this.token.content, {
+          title: '3d secure authentication'
+        }, 'threeDSecure-iframe');
+      } else if (this.token.format === TOKEN_FORMAT$2.STANDALONE_3DS) {
+        this.standalone3dsService.load(this.token.content, {
+          title: '3d secure authentication'
+        });
+      } else {
+        console.error('Token contain unsupported payload');
+      }
     }
     /**
      * Current method can change environment. By default environment = sandbox.
@@ -5617,7 +5673,9 @@ var Canvas3ds = /*#__PURE__*/function () {
       this.link.setEnv(env, alias);
       this.standalone3dsService.setEnv(env, alias);
       for (var index in this.configs) {
-        if (!this.configs.hasOwnProperty(index)) continue;
+        if (!Object.hasOwn(this.configs, index)) {
+          continue;
+        }
         this.configs[index].setEnv(env, alias);
       }
     }
@@ -5627,34 +5685,45 @@ var Canvas3ds = /*#__PURE__*/function () {
       return this.link.getEnv();
     }
     /**
-     * Listen to events of widget
+     * Listen to events of widget.
      *
-     * @example
+     * Available event names are defined in {@link Canvas3dsEventMap} (typed) and
+     * {@link CANVAS_3DS_EVENT} (string constants). Using a literal event name
+     * narrows the callback payload via the typed overloads.
      *
-     * widget.on('chargeAuthReject', function (data) {
-     *      console.log(data);
+     * @example
+     * // Callback form — payload is narrowed by the event name
+     * widget.on('chargeAuthReject', (data) => {
+     *   console.log(data); // data is Canvas3dsAuthPayload | Canvas3dsChargeAuthEventPayload
      * });
-     * // or
-     * widget.on('chargeAuthReject').then(function (data) {
-     *      console.log(data);
+     *
+     * // Promise form
+     * widget.on('chargeAuthReject').then((data) => {
+     *   console.log(data);
      * });
-     * @param {string} eventName - Available event names [EVENT]{@link EVENT} [STANDALONE_3DS_EVENT]{@link STANDALONE_3DS_EVENT}
-     * @param {listener} [cb]
-     * @return {Promise<IEventData> | void}
+     *
+     * @param eventName - Event name from {@link Canvas3dsEventMap} or any string for dynamic events.
+     * @param cb - Optional listener callback. If omitted, returns a Promise that resolves on the next emission.
+     * @returns `void` when a callback is provided; otherwise a Promise that resolves with the event payload.
      */
+    // biome-ignore lint/suspicious/noExplicitAny: implementation signature must accept any payload shape to satisfy all overloads above
   }, {
     key: "on",
     value: function on(eventName, cb) {
       var _this = this;
       if (this.token.format === TOKEN_FORMAT$2.STANDALONE_3DS) {
-        if (typeof cb === 'function') return this.eventEmitter.subscribe(eventName, cb);
+        if (typeof cb === 'function') {
+          return this.eventEmitter.subscribe(eventName, cb);
+        }
         return new Promise(function (resolve) {
           return _this.eventEmitter.subscribe(eventName, function (res) {
             return resolve(res);
           });
         });
       } else {
-        if (typeof cb === 'function') return this.event.on(eventName, this.link.getParams().ref_id, cb);
+        if (typeof cb === 'function') {
+          return this.event.on(eventName, this.link.getParams().ref_id, cb);
+        }
         return new Promise(function (resolve) {
           return _this.event.on(eventName, _this.link.getParams().ref_id, function (res) {
             return resolve(res);
@@ -5698,6 +5767,19 @@ var Canvas3ds = /*#__PURE__*/function () {
   }]);
 }();
 
+/**
+ * Public, tree-shakeable alias for the internal `TOKEN_FORMAT` enum in canvas-3ds.ts.
+ * Mirrors the string values of that enum without exposing the private enum itself.
+ */
+var Canvas3dsTokenFormat = {
+  /** Token whose `content` is a complete HTML page. The SDK renders it inside an iframe. */
+  HTML: 'html',
+  /** Token whose `content` is a URL. The SDK loads it inside an iframe. */
+  URL: 'url',
+  /** Token whose `content` describes a standalone 3DS service (e.g. GPayments). The SDK delegates to that service's flow. */
+  STANDALONE_3DS: 'standalone_3ds'
+};
+
 var Spinner = /*#__PURE__*/function () {
   function Spinner() {
     _classCallCheck(this, Spinner);
@@ -8088,7 +8170,7 @@ var AfterPayWalletService = /*#__PURE__*/function (_WalletService) {
   }]);
 }(WalletService);
 
-/*! @license DOMPurify 3.3.3 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.3.3/LICENSE */
+/*! @license DOMPurify 3.4.0 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.0/LICENSE */
 
 var purify_cjs;
 var hasRequiredPurify_cjs;
@@ -8296,7 +8378,7 @@ function requirePurify_cjs () {
 
 	const html = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'exportparts', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inert', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'nonce', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'part', 'pattern', 'placeholder', 'playsinline', 'popover', 'popovertarget', 'popovertargetaction', 'poster', 'preload', 'pubdate', 'radiogroup', 'readonly', 'rel', 'required', 'rev', 'reversed', 'role', 'rows', 'rowspan', 'spellcheck', 'scope', 'selected', 'shape', 'size', 'sizes', 'slot', 'span', 'srclang', 'start', 'src', 'srcset', 'step', 'style', 'summary', 'tabindex', 'title', 'translate', 'type', 'usemap', 'valign', 'value', 'width', 'wrap', 'xmlns', 'slot']);
 	const svg = freeze(['accent-height', 'accumulate', 'additive', 'alignment-baseline', 'amplitude', 'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseline-shift', 'begin', 'bias', 'by', 'class', 'clip', 'clippathunits', 'clip-path', 'clip-rule', 'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile', 'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction', 'display', 'divisor', 'dur', 'edgemode', 'elevation', 'end', 'exponent', 'fill', 'fill-opacity', 'fill-rule', 'filter', 'filterunits', 'flood-color', 'flood-opacity', 'font-family', 'font-size', 'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform', 'height', 'href', 'id', 'image-rendering', 'in', 'in2', 'intercept', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints', 'keysplines', 'keytimes', 'lang', 'lengthadjust', 'letter-spacing', 'kernelmatrix', 'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid', 'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits', 'maskunits', 'max', 'mask', 'mask-type', 'media', 'method', 'mode', 'min', 'name', 'numoctaves', 'offset', 'operator', 'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order', 'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits', 'points', 'preservealpha', 'preserveaspectratio', 'primitiveunits', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount', 'repeatdur', 'restart', 'result', 'rotate', 'scale', 'seed', 'shape-rendering', 'slope', 'specularconstant', 'specularexponent', 'spreadmethod', 'startoffset', 'stddeviation', 'stitchtiles', 'stop-color', 'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width', 'style', 'surfacescale', 'systemlanguage', 'tabindex', 'tablevalues', 'targetx', 'targety', 'transform', 'transform-origin', 'text-anchor', 'text-decoration', 'text-rendering', 'textlength', 'type', 'u1', 'u2', 'unicode', 'values', 'viewbox', 'visibility', 'version', 'vert-adv-y', 'vert-origin-x', 'vert-origin-y', 'width', 'word-spacing', 'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2', 'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan']);
-	const mathMl = freeze(['accent', 'accentunder', 'align', 'bevelled', 'close', 'columnsalign', 'columnlines', 'columnspan', 'denomalign', 'depth', 'dir', 'display', 'displaystyle', 'encoding', 'fence', 'frame', 'height', 'href', 'id', 'largeop', 'length', 'linethickness', 'lspace', 'lquote', 'mathbackground', 'mathcolor', 'mathsize', 'mathvariant', 'maxsize', 'minsize', 'movablelimits', 'notation', 'numalign', 'open', 'rowalign', 'rowlines', 'rowspacing', 'rowspan', 'rspace', 'rquote', 'scriptlevel', 'scriptminsize', 'scriptsizemultiplier', 'selection', 'separator', 'separators', 'stretchy', 'subscriptshift', 'supscriptshift', 'symmetric', 'voffset', 'width', 'xmlns']);
+	const mathMl = freeze(['accent', 'accentunder', 'align', 'bevelled', 'close', 'columnalign', 'columnlines', 'columnspacing', 'columnspan', 'denomalign', 'depth', 'dir', 'display', 'displaystyle', 'encoding', 'fence', 'frame', 'height', 'href', 'id', 'largeop', 'length', 'linethickness', 'lquote', 'lspace', 'mathbackground', 'mathcolor', 'mathsize', 'mathvariant', 'maxsize', 'minsize', 'movablelimits', 'notation', 'numalign', 'open', 'rowalign', 'rowlines', 'rowspacing', 'rowspan', 'rspace', 'rquote', 'scriptlevel', 'scriptminsize', 'scriptsizemultiplier', 'selection', 'separator', 'separators', 'stretchy', 'subscriptshift', 'supscriptshift', 'symmetric', 'voffset', 'width', 'xmlns']);
 	const xml = freeze(['xlink:href', 'xml:id', 'xlink:title', 'xml:space', 'xmlns:xlink']);
 
 	// eslint-disable-next-line unicorn/better-regex
@@ -8393,7 +8475,7 @@ function requirePurify_cjs () {
 	function createDOMPurify() {
 	  let window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal();
 	  const DOMPurify = root => createDOMPurify(root);
-	  DOMPurify.version = '3.3.3';
+	  DOMPurify.version = '3.4.0';
 	  DOMPurify.removed = [];
 	  if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document || !window.Element) {
 	    // Not running in a browser, provide a factory function
@@ -8669,7 +8751,7 @@ function requirePurify_cjs () {
 	    NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;
 	    MATHML_TEXT_INTEGRATION_POINTS = cfg.MATHML_TEXT_INTEGRATION_POINTS || MATHML_TEXT_INTEGRATION_POINTS;
 	    HTML_INTEGRATION_POINTS = cfg.HTML_INTEGRATION_POINTS || HTML_INTEGRATION_POINTS;
-	    CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {};
+	    CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || create(null);
 	    if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck)) {
 	      CUSTOM_ELEMENT_HANDLING.tagNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck;
 	    }
@@ -8709,13 +8791,10 @@ function requirePurify_cjs () {
 	        addToSet(ALLOWED_ATTR, xml);
 	      }
 	    }
-	    /* Prevent function-based ADD_ATTR / ADD_TAGS from leaking across calls */
-	    if (!objectHasOwnProperty(cfg, 'ADD_TAGS')) {
-	      EXTRA_ELEMENT_HANDLING.tagCheck = null;
-	    }
-	    if (!objectHasOwnProperty(cfg, 'ADD_ATTR')) {
-	      EXTRA_ELEMENT_HANDLING.attributeCheck = null;
-	    }
+	    /* Always reset function-based ADD_TAGS / ADD_ATTR checks to prevent
+	     * leaking across calls when switching from function to array config */
+	    EXTRA_ELEMENT_HANDLING.tagCheck = null;
+	    EXTRA_ELEMENT_HANDLING.attributeCheck = null;
 	    /* Merge configuration parameters */
 	    if (cfg.ADD_TAGS) {
 	      if (typeof cfg.ADD_TAGS === 'function') {
@@ -9038,6 +9117,11 @@ function requirePurify_cjs () {
 	      _forceRemove(currentNode);
 	      return true;
 	    }
+	    /* Remove risky CSS construction leading to mXSS */
+	    if (SAFE_FOR_XML && currentNode.namespaceURI === HTML_NAMESPACE && tagName === 'style' && _isNode(currentNode.firstElementChild)) {
+	      _forceRemove(currentNode);
+	      return true;
+	    }
 	    /* Remove any occurrence of processing instructions */
 	    if (currentNode.nodeType === NODE_TYPE.progressingInstruction) {
 	      _forceRemove(currentNode);
@@ -9049,7 +9133,7 @@ function requirePurify_cjs () {
 	      return true;
 	    }
 	    /* Remove element if anything forbids its presence */
-	    if (!(EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function && EXTRA_ELEMENT_HANDLING.tagCheck(tagName)) && (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName])) {
+	    if (FORBID_TAGS[tagName] || !(EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function && EXTRA_ELEMENT_HANDLING.tagCheck(tagName)) && !ALLOWED_TAGS[tagName]) {
 	      /* Check if we have a custom element to handle */
 	      if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
 	        if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) {
@@ -9288,7 +9372,7 @@ function requirePurify_cjs () {
 	   *
 	   * @param fragment to iterate over recursively
 	   */
-	  const _sanitizeShadowDOM = function _sanitizeShadowDOM(fragment) {
+	  const _sanitizeShadowDOM2 = function _sanitizeShadowDOM(fragment) {
 	    let shadowNode = null;
 	    const shadowIterator = _createNodeIterator(fragment);
 	    /* Execute a hook if present */
@@ -9302,7 +9386,7 @@ function requirePurify_cjs () {
 	      _sanitizeAttributes(shadowNode);
 	      /* Deep shadow DOM detected */
 	      if (shadowNode.content instanceof DocumentFragment) {
-	        _sanitizeShadowDOM(shadowNode.content);
+	        _sanitizeShadowDOM2(shadowNode.content);
 	      }
 	    }
 	    /* Execute a hook if present */
@@ -9397,7 +9481,7 @@ function requirePurify_cjs () {
 	      _sanitizeAttributes(currentNode);
 	      /* Shadow DOM detected, sanitize it */
 	      if (currentNode.content instanceof DocumentFragment) {
-	        _sanitizeShadowDOM(currentNode.content);
+	        _sanitizeShadowDOM2(currentNode.content);
 	      }
 	    }
 	    /* If we sanitized `dirty` in-place, return it. */
@@ -9406,6 +9490,14 @@ function requirePurify_cjs () {
 	    }
 	    /* Return sanitized string or DOM */
 	    if (RETURN_DOM) {
+	      if (SAFE_FOR_TEMPLATES) {
+	        body.normalize();
+	        let html = body.innerHTML;
+	        arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
+	          html = stringReplace(html, expr, ' ');
+	        });
+	        body.innerHTML = html;
+	      }
 	      if (RETURN_DOM_FRAGMENT) {
 	        returnNode = createDocumentFragment.call(body.ownerDocument);
 	        while (body.firstChild) {
@@ -10238,6 +10330,44 @@ var FlypayWalletService = /*#__PURE__*/function (_WalletService) {
   }]);
 }(WalletService);
 
+/**
+ * Maximum Apple Pay JS API version the SDK targets.
+ * Bump this when adopting features from a newer version.
+ */
+var APPLE_PAY_MAX_VERSION = 14;
+/**
+ * Minimum Apple Pay JS API version the SDK can operate with.
+ *
+ * Version 3 (iOS 11 / macOS 10.13) is required because the SDK uses:
+ * - `ApplePayError` constructor
+ * - Object-form `completeShippingContactSelection(update)`
+ * - Object-form `completeShippingMethodSelection(update)`
+ * - `supportedCountries` in payment requests
+ *
+ * All of these were introduced in version 3.
+ */
+var APPLE_PAY_MIN_VERSION = 3;
+/**
+ * Detects the highest Apple Pay JS API version the current device supports,
+ * starting from {@link APPLE_PAY_MAX_VERSION} down to {@link APPLE_PAY_MIN_VERSION}.
+ *
+ * Returns `0` if Apple Pay is not available or the device does not support
+ * the minimum required version.
+ *
+ * @see https://developer.apple.com/documentation/apple_pay_on_the_web/applepaysession/supportsversion
+ */
+function getSupportedApplePayVersion() {
+  if (!window.ApplePaySession) {
+    return 0;
+  }
+  for (var v = APPLE_PAY_MAX_VERSION; v >= APPLE_PAY_MIN_VERSION; v--) {
+    if (ApplePaySession.supportsVersion(v)) {
+      return v;
+    }
+  }
+  return 0;
+}
+
 var DEFAULT_APPLE_PAY_CAPABILITIES$2 = ['paymentCredentialsAvailable'];
 var AppleWalletService = /*#__PURE__*/function (_WalletService) {
   function AppleWalletService(publicKey, meta, gatewayName, eventEmitter) {
@@ -10567,7 +10697,14 @@ var AppleWalletService = /*#__PURE__*/function (_WalletService) {
     key: "onApplePayButtonClicked",
     value: function onApplePayButtonClicked() {
       var _this5 = this;
-      this.paymentSession = new ApplePaySession(14, this.createRequest());
+      var applePayApiVersion = getSupportedApplePayVersion();
+      if (applePayApiVersion === 0) {
+        this.eventEmitter.emit(WALLET_EVENT.UNAVAILABLE, {
+          wallet: WALLET_TYPE.APPLE
+        });
+        return;
+      }
+      this.paymentSession = new ApplePaySession(applePayApiVersion, this.createRequest());
       this.paymentSession.onvalidatemerchant = this.onValidateMerchant;
       this.paymentSession.onpaymentauthorized = this.onPaymentAuthorized;
       this.paymentSession.oncancel = this.onCancelPayment;
@@ -12728,28 +12865,59 @@ function getHandleCvv(configuration) {
   }
 }
 
+/**
+ * Top-level classification of an error. Used by the SDK to route errors to the
+ * right category in instrumentation and to give consumers a coarse-grained
+ * tag for grouping/filtering. See {@link getErrorCategory} for the mapping
+ * between {@link ERROR_CAUSE} and {@link ERROR_CATEGORY}.
+ */
 var ERROR_CATEGORY = {
+  /** SDK was misconfigured (missing keys, invalid options, etc.). */
   CONFIGURATION: 'configuration',
+  /** Authentication or authorization failure. */
   IDENTITY: 'identity_access_management',
+  /** SDK internal failure or upstream service problem. */
   INTERNAL: 'internal',
+  /** Flow lifecycle event (user cancelled, aborted, etc.) — not a real fault. */
   PROCESS: 'process',
+  /** Resource lookup failed or was rate-limited. */
   RESOURCE: 'resource',
+  /** Invalid input or business-rule validation failure. */
   VALIDATION: 'validation'
 };
+/**
+ * Concrete cause of an error. More specific than {@link ERROR_CATEGORY} —
+ * useful for deciding programmatic responses (e.g. show a retry button only
+ * when `cause` is `'service_unreachable'` or `'server_busy'`).
+ */
 var ERROR_CAUSE = {
+  /** Operation was aborted programmatically. */
   ABORTED: 'aborted',
+  /** Caller has insufficient permissions for the operation. */
   ACCESS_FORBIDDEN: 'access_forbidden',
+  /** Resource already exists when create was expected. */
   ALREADY_EXISTS: 'already_exists',
+  /** User cancelled the flow (e.g. closed the wallet sheet). */
   CANCELED: 'canceled',
+  /** SDK was instantiated or invoked with invalid configuration. */
   INVALID_CONFIGURATION: 'invalid_configuration',
+  /** Input failed structural or business-rule validation. */
   INVALID_INPUT: 'invalid_input',
+  /** Resource was not found by the backend. */
   NOT_FOUND: 'not_found',
+  /** Operation is not supported in the current context or version. */
   NOT_IMPLEMENTED: 'not_implemented',
+  /** Caller exceeded the allowed request rate. */
   RATE_LIMITED: 'rate_limited',
+  /** Backend is healthy but currently overloaded — typically retryable. */
   SERVER_BUSY: 'server_busy',
+  /** Backend or third-party service could not be reached — typically retryable. */
   SERVICE_UNREACHABLE: 'service_unreachable',
+  /** Caller is not authenticated. */
   UNAUTHORIZED: 'unauthorized',
+  /** Catch-all when no other cause applies. */
   UNKNOWN: 'unknown_error',
+  /** Request was syntactically valid but semantically rejected. */
   UNPROCESSABLE_ENTITY: 'unprocessable_entity'
 };
 var EventError = /*#__PURE__*/function (_Error) {
@@ -14809,7 +14977,6 @@ var InstructionCanvas3dsShow$1 = /*#__PURE__*/function (_InstructionHandler) {
       });
       canvas.on('chargeAuthReject', function () {
         var _a;
-        // **TODO add interface for chargeAuthReject event **//
         (_a = _this.checkoutWidget) === null || _a === void 0 ? void 0 : _a.fetchInstruction();
         _this.api.checkout().callback({
           event: 'callback.child_widget.status',
@@ -14826,13 +14993,13 @@ var InstructionCanvas3dsShow$1 = /*#__PURE__*/function (_InstructionHandler) {
       });
       canvas.on('error', function (event) {
         var _a;
-        // **TODO add interface for error event **//
         (_a = _this.checkoutWidget) === null || _a === void 0 ? void 0 : _a.fetchInstruction();
+        var message = (event && _typeof$1(event) === 'object' && 'event' in event ? event.event : null) || 'error in 3ds widget';
         _this.api.checkout().callback({
           event: 'callback.child_widget.status',
           payload: {
             status: 'error',
-            message: (event === null || event === void 0 ? void 0 : event.event) || 'error in 3ds widget'
+            message: message
           }
         }).then(function () {
           return console.info('callback.child_widget.status: - errorEvent');
@@ -17200,7 +17367,6 @@ var InstructionCanvas3dsShow = /*#__PURE__*/function (_InstructionHandler) {
       });
       canvas.on('chargeAuthReject', function () {
         var _a;
-        // **TODO add interface for chargeAuthReject event **//
         (_a = _this.checkoutWidget) === null || _a === void 0 ? void 0 : _a.fetchInstruction();
         _this.api.checkout().callback({
           event: 'callback.child_widget.status',
@@ -17217,13 +17383,13 @@ var InstructionCanvas3dsShow = /*#__PURE__*/function (_InstructionHandler) {
       });
       canvas.on('error', function (event) {
         var _a;
-        // **TODO add interface for error event **//
         (_a = _this.checkoutWidget) === null || _a === void 0 ? void 0 : _a.fetchInstruction();
+        var message = (event && _typeof$1(event) === 'object' && 'event' in event ? event.event : null) || 'error in 3ds widget';
         _this.api.checkout().callback({
           event: 'callback.child_widget.status',
           payload: {
             status: 'error',
-            message: (event === null || event === void 0 ? void 0 : event.event) || 'error in 3ds widget'
+            message: message
           }
         }).then(function () {
           return console.info('callback.child_widget.status: - errorEvent');
@@ -18590,10 +18756,16 @@ function getCheckoutVersionHandler(version) {
   }
 }
 
+/** Event name emitted when a checkout payment completes successfully. */
+var PAYMENT_SUCCESSFUL = 'paymentSuccessful';
+/** Event name emitted when a checkout payment fails. */
+var PAYMENT_FAILURE = 'paymentFailure';
+/** Event name emitted when a checkout session expires. */
+var PAYMENT_EXPIRED = 'paymentExpired';
 var EVENT$3 = {
-  PAYMENT_SUCCESSFUL: 'paymentSuccessful',
-  PAYMENT_FAILURE: 'paymentFailure',
-  PAYMENT_EXPIRED: 'paymentExpired'
+  PAYMENT_SUCCESSFUL: PAYMENT_SUCCESSFUL,
+  PAYMENT_FAILURE: PAYMENT_FAILURE,
+  PAYMENT_EXPIRED: PAYMENT_EXPIRED
 };
 /**
  * Class CheckoutButton transform usual button into checkout
@@ -18618,7 +18790,7 @@ var Checkout = /*#__PURE__*/function () {
     this.checkoutFinished = false;
     try {
       this.eventEmitter = new EventEmitter();
-      this.intentTokenPayload = this.extractIntentTokenPayload(intentToken);
+      this.intentTokenPayload = this.extractCheckoutIntentTokenPayload(intentToken);
       this.checkoutVersionHandler = getCheckoutVersionHandler(this.intentTokenPayload.version);
       this.instructions = this.initContractVersion();
       this.api = new ApiInternal(this.intentToken, API_AUTH_TYPE.TOKEN);
@@ -18679,8 +18851,8 @@ var Checkout = /*#__PURE__*/function () {
       }, 14 * 60 * 1000 + 45 * 1000);
     }
   }, {
-    key: "extractIntentTokenPayload",
-    value: function extractIntentTokenPayload(intentToken) {
+    key: "extractCheckoutIntentTokenPayload",
+    value: function extractCheckoutIntentTokenPayload(intentToken) {
       var tokenContent = AccessToken.validateJWT(intentToken);
       if (!tokenContent) {
         throw new Error('Intent token is broken or expired. Please, issue new one.');
@@ -18708,7 +18880,7 @@ var Checkout = /*#__PURE__*/function () {
     value: function ready() {
       var _this3 = this;
       this.changeLoadingSpinnerVisibility(true);
-      // biome-ignore lint/suspicious/noExplicitAny: <explanation>
+      // biome-ignore lint/suspicious/noExplicitAny: checkoutApi.status returns a dynamic shape whose fields are narrowed at the call-sites below
       this.checkoutApi.status(this.intentTokenPayload.intent_id).then(function (response) {
         if (!(response === null || response === void 0 ? void 0 : response.status)) {
           throw new Error('Checkout Intent Status structure inconsistent');
@@ -18817,8 +18989,8 @@ var Checkout = /*#__PURE__*/function () {
      * Important: Do not perform thread blocking operations in callback such as window.alert() calls.
      *
      * @example
-     * widget.onPaymentInReview((data) => {
-     *      console.log('Payment in fraud review');
+     * widget.onPaymentExpired((data) => {
+     *      console.log('Payment session expired');
      * });
      */
   }, {
@@ -18939,7 +19111,15 @@ var OpenWalletButtons = /*#__PURE__*/function () {
   function OpenWalletButtons(selector, publicKeyOrAccessToken, serviceId, meta) {
     _classCallCheck(this, OpenWalletButtons);
     this.env = DEFAULT_ENV;
+    this.isDisabled = false;
     this.onShippingOptionsChangeHandlerRegistered = false;
+    // Runtime guard: TypeScript's `abstract` keyword exists only at compile time.
+    // Without this check, instantiating the base class directly silently fails
+    // later when `this.validateWalletMeta()` resolves to `undefined`, producing
+    // a confusing "is not a function" error far from the actual mistake.
+    if ((this instanceof OpenWalletButtons ? this.constructor : void 0) === OpenWalletButtons) {
+      throw new Error('OpenWalletButtons is an abstract base class and cannot be instantiated directly. ' + 'Use ApplePayOpenWalletButton or GooglePayOpenWalletButton instead.');
+    }
     this.eventEmitter = new EventEmitter();
     this.container = new Container(selector);
     this.api = new ApiInternal(publicKeyOrAccessToken, this.getApiAuthType(publicKeyOrAccessToken));
@@ -19076,6 +19256,68 @@ var OpenWalletButtons = /*#__PURE__*/function () {
         _this.handleOnError(error instanceof Error ? error : new Error(String(error)), ERROR_OPERATION.CONFIGURATION);
       });
     }
+    /**
+     * Enables the wallet button, restoring interactivity and visual appearance.
+     * If the button was previously disabled via `disable()`, calling this method
+     * re-enables clicks and removes the disabled visual state.
+     *
+     * Idempotent — calling on an already-enabled button has no effect.
+     *
+     * @example
+     * button.enable();
+     */
+  }, {
+    key: "enable",
+    value: function enable() {
+      this.isDisabled = false;
+      this.applyDisabledStyles();
+    }
+    /**
+     * Disables the wallet button, preventing clicks and applying a visual disabled state.
+     * When disabled, the button appears grayed out (`opacity: 0.5`) and does not
+     * respond to user interaction (`pointer-events: none`). For accessibility, the
+     * `aria-disabled="true"` attribute is also set on the container.
+     *
+     * Programmatic clicks (e.g. invoked by the wallet provider's SDK) are blocked
+     * by an explicit guard inside the click handler — the button's wallet service
+     * checks the disabled state before processing.
+     *
+     * Idempotent — calling on an already-disabled button has no effect.
+     * Safe to call before `load()` (no-throw); the styles are applied once the
+     * container element exists.
+     *
+     * @example
+     * button.disable();
+     */
+  }, {
+    key: "disable",
+    value: function disable() {
+      this.isDisabled = true;
+      this.applyDisabledStyles();
+    }
+    /**
+     * Applies the disabled / enabled visual state to the container element.
+     * Reads `this.isDisabled` and toggles the corresponding CSS + ARIA attributes.
+     *
+     * @private
+     */
+  }, {
+    key: "applyDisabledStyles",
+    value: function applyDisabledStyles() {
+      var element = this.container.getElement();
+      if (!element) {
+        return;
+      }
+      if (this.isDisabled) {
+        element.style.pointerEvents = 'none';
+        element.style.opacity = '0.5';
+        element.setAttribute('aria-disabled', 'true');
+      } else {
+        element.style.pointerEvents = '';
+        element.style.opacity = '';
+        element.removeAttribute('aria-disabled');
+      }
+    }
     /**
      * Current method can change environment. By default environment = sandbox.
      * Also we can change domain alias for this environment. By default domain_alias = paydock.com
@@ -19565,7 +19807,9 @@ var SERVICE_GROUP;
  * Returns `undefined` if the resulting object has no remaining properties.
  */
 function stripEmpty(obj) {
-  if (!obj || _typeof$1(obj) !== 'object') return undefined;
+  if (!obj || _typeof$1(obj) !== 'object') {
+    return undefined;
+  }
   var result = {};
   for (var _i = 0, _Object$entries = Object.entries(obj); _i < _Object$entries.length; _i++) {
     var _Object$entries$_i = _slicedToArray(_Object$entries[_i], 2),
@@ -19614,13 +19858,30 @@ var OpenWalletService = /*#__PURE__*/function () {
     this.serviceGroup = SERVICE_GROUP.WALLET;
   }
   /**
-   * Creates a One-Time Token (OTT) by sending the payment data to the API.
-   * Emits {@link EVENT.SUCCESS} on success or {@link EVENT.ERROR} on failure.
+   * Returns whether the wallet button is currently disabled.
+   * Reads the `aria-disabled` attribute from the container element — set by the
+   * button class via {@link OpenWalletButtons.disable} / {@link OpenWalletButtons.enable}.
+   *
+   * Used to short-circuit click handlers in concrete wallet services for clicks
+   * that bypass the DOM `pointer-events: none` guard (e.g. invoked by the wallet
+   * provider's SDK callback).
    *
-   * @param data - The payment data including amount, shipping, billing, card info, and ref token.
-   * @returns A promise resolving to the OTT response.
+   * @returns `true` if the container is marked as disabled, `false` otherwise.
    */
   return _createClass(OpenWalletService, [{
+    key: "isButtonDisabled",
+    value: function isButtonDisabled() {
+      var element = this.container.getElement();
+      return (element === null || element === void 0 ? void 0 : element.getAttribute('aria-disabled')) === 'true';
+    }
+    /**
+     * Creates a One-Time Token (OTT) by sending the payment data to the API.
+     * Emits {@link EVENT.SUCCESS} on success or {@link EVENT.ERROR} on failure.
+     *
+     * @param data - The payment data including amount, shipping, billing, card info, and ref token.
+     * @returns A promise resolving to the OTT response.
+     */
+  }, {
     key: "createOTT",
     value: function createOTT(data) {
       var _this = this;
@@ -20141,7 +20402,15 @@ var ApplePayOpenWalletService = /*#__PURE__*/function (_OpenWalletService) {
     key: "onApplePayButtonClicked",
     value: function onApplePayButtonClicked() {
       var _this7 = this;
-      this.paymentSession = new ApplePaySession(14, this.mapMetaToApplePayPaymentRequest());
+      if (this.isButtonDisabled()) {
+        return;
+      }
+      var applePayApiVersion = getSupportedApplePayVersion();
+      if (applePayApiVersion === 0) {
+        this.handleOnUnavailable('Apple Pay version not supported');
+        return;
+      }
+      this.paymentSession = new ApplePaySession(applePayApiVersion, this.mapMetaToApplePayPaymentRequest());
       this.paymentSession.onvalidatemerchant = this.onValidateMerchant;
       this.paymentSession.onpaymentauthorized = this.onPaymentAuthorized;
       this.paymentSession.oncancel = this.onCancelPayment;
@@ -20886,6 +21155,9 @@ var GooglePayOpenWalletService = /*#__PURE__*/function (_OpenWalletService) {
     key: "onGooglePayButtonClicked",
     value: function onGooglePayButtonClicked() {
       var _this5 = this;
+      if (this.isButtonDisabled()) {
+        return;
+      }
       if (this.processingButtonClick) {
         console.warn('Google Pay button clicked while processing.');
         return;
@@ -22999,6 +23271,7 @@ var BaseWalletButton = /*#__PURE__*/function () {
   function BaseWalletButton(selector, publicKeyOrAccessToken, gatewayId, meta, requiredMetaFields) {
     _classCallCheck(this, BaseWalletButton);
     this.env = DEFAULT_ENV;
+    this.isDisabled = false;
     this.onShippingOptionsChangeHandlerRegistered = false;
     this.eventEmitter = new EventEmitter();
     this.container = new Container(selector);
@@ -23031,6 +23304,30 @@ var BaseWalletButton = /*#__PURE__*/function () {
       this.env = env;
       this.api.setEnv(env, alias);
     }
+    /**
+     * Enables the wallet button, restoring interactivity and visual appearance.
+     *
+     * @example
+     * button.enable();
+     */
+  }, {
+    key: "enable",
+    value: function enable() {
+      this.isDisabled = false;
+      this.applyDisabledStyles();
+    }
+    /**
+     * Disables the wallet button, preventing clicks and applying a visual disabled state.
+     *
+     * @example
+     * button.disable();
+     */
+  }, {
+    key: "disable",
+    value: function disable() {
+      this.isDisabled = true;
+      this.applyDisabledStyles();
+    }
     /**
      * Callback for onClick method.
      *
@@ -23495,6 +23792,23 @@ var BaseWalletButton = /*#__PURE__*/function () {
         code: ((_c = err === null || err === void 0 ? void 0 : err.error) === null || _c === void 0 ? void 0 : _c.code) || (err === null || err === void 0 ? void 0 : err.code) || ((_d = err === null || err === void 0 ? void 0 : err.error_summary) === null || _d === void 0 ? void 0 : _d.code)
       };
     }
+  }, {
+    key: "applyDisabledStyles",
+    value: function applyDisabledStyles() {
+      var element = this.container.getElement();
+      if (!element) {
+        return;
+      }
+      if (this.isDisabled) {
+        element.style.pointerEvents = 'none';
+        element.style.opacity = '0.5';
+        element.setAttribute('aria-disabled', 'true');
+      } else {
+        element.style.pointerEvents = '';
+        element.style.opacity = '';
+        element.removeAttribute('aria-disabled');
+      }
+    }
   }, {
     key: "validateRequiredMetaFields",
     value: function validateRequiredMetaFields(requiredMetaFields) {
@@ -23566,7 +23880,14 @@ var ApplePayWalletButtonExpress = /*#__PURE__*/function (_BaseWalletButton) {
     _classCallCheck(this, ApplePayWalletButtonExpress);
     _this = _callSuper(this, ApplePayWalletButtonExpress, [selector, publicKeyOrAccessToken, gatewayId, meta, ['amount_label', 'country']]);
     _this.onApplePayButtonClicked = function () {
-      var applePayApiVersion = 14;
+      if (_this.isDisabled) {
+        return;
+      }
+      var applePayApiVersion = getSupportedApplePayVersion();
+      if (applePayApiVersion === 0) {
+        _this.handleOnUnavailable();
+        return;
+      }
       _this.paymentSession = new ApplePaySession(applePayApiVersion, _this.createRequest());
       _this.paymentSession.onvalidatemerchant = _this.onValidateMerchant;
       _this.paymentSession.onpaymentauthorized = _this.onPaymentAuthorized;
@@ -23844,6 +24165,7 @@ var ApplePayWalletButtonExpress = /*#__PURE__*/function (_BaseWalletButton) {
         return;
       }
       applePayButton.addEventListener('click', this.onApplePayButtonClicked.bind(this));
+      this.applyDisabledStyles();
     }
   }, {
     key: "createRequest",
@@ -24036,13 +24358,20 @@ var PaypalWalletButtonExpress = /*#__PURE__*/function (_BaseWalletButton) {
     key: "load",
     value: function load() {
       var _this2 = this;
-      if (!window.Promise) return this.handleOnUnavailable();
+      if (!window.Promise) {
+        return this.handleOnUnavailable();
+      }
       this.getGatewayWalletConfig().then(function (config) {
-        if (!config || config.type !== 'Paypal' || !config.credentials || !config.credentials.client_auth) throw new Error('Invalid configuration');
+        if (!config || config.type !== 'Paypal' || !config.credentials || !config.credentials.client_auth) {
+          throw new Error('Invalid configuration');
+        }
         _this2.config = config;
         _this2.renderPaypalButton();
+        _this2.applyDisabledStyles();
       })["catch"](function (err) {
-        if (err) _this2.handleOnError(err);
+        if (err) {
+          _this2.handleOnError(err);
+        }
         _this2.handleOnUnavailable();
       });
     }
@@ -24059,6 +24388,7 @@ var PaypalWalletButtonExpress = /*#__PURE__*/function (_BaseWalletButton) {
     value: function setMeta(meta) {
       this.meta = meta;
       this.renderPaypalButton();
+      this.applyDisabledStyles();
     }
   }, {
     key: "renderPaypalButton",
@@ -24075,7 +24405,7 @@ var PaypalWalletButtonExpress = /*#__PURE__*/function (_BaseWalletButton) {
       var _this3 = this;
       var _a, _b;
       var buttonId = ((_a = this.container.getElement()) === null || _a === void 0 ? void 0 : _a.id) || '';
-      var paypalScript = document.createElement("script");
+      var paypalScript = document.createElement('script');
       paypalScript.src = "https://www.paypal.com/sdk/js?client-id=".concat((_b = this.config.credentials) === null || _b === void 0 ? void 0 : _b.client_auth, "&currency=").concat(this.meta.currency).concat(this.meta.pay_later === true ? '&enable-funding=paylater&disable-funding=card' : '&disable-funding=credit,card').concat(!this.meta.capture ? '&intent=authorize' : '');
       paypalScript.async = true;
       paypalScript.onload = function () {
@@ -24094,7 +24424,7 @@ var PaypalWalletButtonExpress = /*#__PURE__*/function (_BaseWalletButton) {
       var _this4 = this;
       var _a, _b, _c;
       var buttonId = ((_a = this.container.getElement()) === null || _a === void 0 ? void 0 : _a.id) || '';
-      var paypalScript = document.createElement("script");
+      var paypalScript = document.createElement('script');
       // buyer-country is only used in Sandbox. It shouldn't be used in production. Based on buyer's geolocation this parameter determine which funding sources are eligible for a given buyer. Refer the link https://developer.paypal.com/sdk/js/configuration/#link-buyercountry
       paypalScript.src = "https://www.paypal.com/sdk/js?client-id=".concat((_b = this.config.credentials) === null || _b === void 0 ? void 0 : _b.client_auth, "&currency=").concat(this.meta.currency, "&components=buttons,funding-eligibility,messages&enable-funding=paylater").concat(!this.meta.capture ? '&intent=authorize' : '').concat(((_c = this.config) === null || _c === void 0 ? void 0 : _c.mode) === 'live' ? '' : '&buyer-country=AU');
       paypalScript.async = true;
@@ -24135,6 +24465,9 @@ var PaypalWalletButtonExpress = /*#__PURE__*/function (_BaseWalletButton) {
         style: this.meta.style
       }), {
         onClick: function onClick(_data, actions) {
+          if (_this5.isDisabled) {
+            return actions.reject();
+          }
           return _this5.handleMerchantOnExpressButtonClickEvent().then(function () {
             return actions.resolve();
           })["catch"](function () {
@@ -24145,7 +24478,9 @@ var PaypalWalletButtonExpress = /*#__PURE__*/function (_BaseWalletButton) {
         createOrder: function createOrder() {
           return new Promise(function (resolve, reject) {
             var _a, _b;
-            if (!_this5.api.auth) return reject(new Error('Wallet Token not injected. Please handle onClick correctly.'));
+            if (!_this5.api.auth) {
+              return reject(new Error('Wallet Token not injected. Please handle onClick correctly.'));
+            }
             var shipping = (_b = (_a = _this5.chargeWalletTokenMeta) === null || _a === void 0 ? void 0 : _a.charge) === null || _b === void 0 ? void 0 : _b.shipping;
             if (shipping) {
               var hasCompleteShippingAddress = ['address_line1', 'address_city', 'address_country', 'address_state', 'address_postcode'].every(function (key) {
@@ -24164,7 +24499,9 @@ var PaypalWalletButtonExpress = /*#__PURE__*/function (_BaseWalletButton) {
           });
         },
         onApprove: function onApprove(data) {
-          if (_this5.pendingApprovalPromise) return _this5.pendingApprovalPromise;
+          if (_this5.pendingApprovalPromise) {
+            return _this5.pendingApprovalPromise;
+          }
           _this5.pendingApprovalPromise = _this5.executeWalletCapture({
             payment_method_id: data.orderID,
             customer: {
@@ -44342,4 +44679,4 @@ var browser = /*#__PURE__*/Object.freeze({
   zlibSync: zlibSync
 });
 
-export { AfterpayCheckoutButton, AfterpayOnSiteMessaging, Api, ApplePayOpenWalletButton, ApplePayWalletButtonExpress, CHECKOUT_BUTTON_EVENT, Canvas3ds, Checkout, ClickToPay, Configuration, ELEMENT, ERROR_OPERATION, EVENT$5 as EVENT, Builder$1 as ExternalCheckoutBuilder, Checker as ExternalCheckoutChecker, FORM_FIELD$1 as FORM_FIELD, FRAUD_PREVENTION_EVENTS, FraudPreventionService, GooglePayOpenWalletButton, HtmlMultiWidget, HtmlPaymentSourceWidget, HtmlWidget, InstructionDebugger, MultiWidget, OpenWalletButtons, PAYMENT_TYPE, PURPOSE, PayPalDataCollector, PayPalSavePaymentSourceWidget, Builder as PaymentSourceBuilder, PaymentSourceWidget, PaypalCheckoutButton, PaypalWalletButtonExpress, STYLABLE_ELEMENT, STYLABLE_ELEMENT_STATE, STYLE$2 as STYLE, SUPPORTED_CARD_TYPES, TEXT, TOKEN_TYPE, TRIGGER$1 as TRIGGER, TYPE, VAULT_DISPLAY_STYLE, VaultDisplayWidget, WALLET_TYPES, WalletButtons, ZipmoneyCheckoutButton };
+export { AfterpayCheckoutButton, AfterpayOnSiteMessaging, Api, ApplePayOpenWalletButton, ApplePayWalletButtonExpress, CANVAS_3DS_EVENT, CHECKOUT_BUTTON_EVENT, EVENT$3 as CHECKOUT_EVENT, Canvas3ds, Canvas3dsTokenFormat, Checkout, ClickToPay, Configuration, ContactShippingEditingMode, ELEMENT, ERROR_OPERATION, EVENT$5 as EVENT, Builder$1 as ExternalCheckoutBuilder, Checker as ExternalCheckoutChecker, FORM_FIELD$1 as FORM_FIELD, FRAUD_PREVENTION_EVENTS, FraudPreventionService, GooglePayOpenWalletButton, HtmlMultiWidget, HtmlPaymentSourceWidget, HtmlWidget, InstructionDebugger, MultiWidget, PAYMENT_EXPIRED, PAYMENT_FAILURE, PAYMENT_SUCCESSFUL, PAYMENT_TYPE, PURPOSE, PayPalDataCollector, PayPalSavePaymentSourceWidget, Builder as PaymentSourceBuilder, PaymentSourceWidget, PaypalCheckoutButton, PaypalWalletButtonExpress, STYLABLE_ELEMENT, STYLABLE_ELEMENT_STATE, STYLE$2 as STYLE, SUPPORTED_CARD_TYPES, TEXT, TOKEN_TYPE, TRIGGER$1 as TRIGGER, TYPE, VAULT_DISPLAY_STYLE, VaultDisplayWidget, EVENT as WALLET_BUTTONS_EXPRESS_EVENT, WALLET_TYPES, WalletButtons, ZipmoneyCheckoutButton };