@paydock/client-sdk 1.145.0-beta → 1.147.0

package/bundles/widget.umd.js.d.ts

@@ -259,6 +259,24 @@ declare const SUPPORTED_CARD_TYPES: {
     EFTPOS_WHITE: string;
     UNIONPAY: string;
 };
+/**
+ * Card schemes the widget is able to resolve from a card number, and therefore the only values
+ * `setAllowedCardSchemes` accepts. This is a separate vocabulary from SUPPORTED_CARD_TYPES, which drives the
+ * card icons: it omits the icon-only variants `visa_white` / `eftpos_white`, and the `laser` / `maestro`
+ * identifiers the widget can never resolve — allowing those would be configuration that can never match.
+ */
+declare const CARD_SCHEME: {
+    AMEX: string;
+    AUSBC: string;
+    DINERS: string;
+    DISCOVER: string;
+    EFTPOS: string;
+    JAPCB: string;
+    MASTERCARD: string;
+    SOLO: string;
+    UNIONPAY: string;
+    VISA: string;
+};
 interface IIcons {
     paypal_checkout_button?: string;
     afterpay_checkout_button?: string;
@@ -362,6 +380,7 @@ interface IParams extends IStyles$1, ITexts, ICommonParams {
     ref_id?: string;
     supported_card_types?: string;
     validate_card_types?: boolean;
+    allowed_card_schemes?: string;
     fields_validation?: boolean;
     hidden_elements?: string;
     icons?: string;
@@ -767,10 +786,15 @@ declare class Configuration {
 declare class IFrame {
     protected container: Container;
     constructor(container: Container);
+    /**
+     * @param options.onLoad Called on every `load` of the iframe (initial document and each
+     *        subsequent navigation). Attached before `src` is set so a fast load is never missed.
+     */
     load(link: string, options?: {
         title?: string;
         attributes?: Record<string, string>;
         styles?: Record<string, string>;
+        onLoad?: (event: Event) => void;
     }, iframeClass?: string): void;
     loadFromHtml(content: string, options?: {
         title?: string;
@@ -842,15 +866,16 @@ declare const EVENT$3: {
 type EventTypes = typeof EVENT$3[keyof typeof EVENT$3];
 interface Listener {
     event: string;
-    listener: (event: any) => void;
+    /** `origin` is the `MessageEvent.origin` of the postMessage that carried the data (undefined for direct `emit`). */
+    listener: (event: any, origin?: string) => void;
     widget_id: string;
 }
 declare type Listeners = Listener[];
 declare class IFrameEvent {
     protected listeners: Listeners;
     constructor(subject: Window | null);
-    emit(data: IEventData$1): void;
-    on<T>(eventName: string, widgetId: string, cb: (data: T) => void): void;
+    emit(data: IEventData$1, origin?: string): void;
+    on<T>(eventName: string, widgetId: string, cb: (data: T, origin?: string) => void): void;
     clear(): void;
     private subscribe;
 }
@@ -1206,6 +1231,25 @@ declare class MultiWidget {
      * @param {boolean} validateCardNumberInput - [validateCardNumberInput=false] - using this param you allow validation for card number input on supported card types
      */
     setSupportedCardIcons(elements: string[], validateCardNumberInput?: boolean): void;
+    /**
+     * Current method restricts which card schemes the card number input accepts, without changing which card
+     * icons the widget displays. Scheme identifiers are matched case-insensitively and ignoring surrounding
+     * whitespace; unsupported identifiers are ignored with a warning, so a list in which every identifier is
+     * unsupported applies no restriction at all.
+     *
+     * Takes precedence over setSupportedCardIcons: when a non-empty list is supplied here, it is the only list
+     * used for validation and the validateCardNumberInput flag of setSupportedCardIcons no longer affects it.
+     * Calling this method more than once replaces the previous list rather than merging with it.
+     *
+     * Must be called before load().
+     *
+     * @example
+     *
+     * widget.setAllowedCardSchemes(['visa', 'mastercard']);
+     *
+     * @param {string[]} schemes - [CARD_SCHEME]{@link CARD_SCHEME}
+     */
+    setAllowedCardSchemes(schemes: string[]): void;
     /**
      * Current method can hide prevent the widget from showing the error messages
      *
@@ -2171,6 +2215,12 @@ declare class ApiBase {
      * @param {string} [alias] - Own domain alias
      */
     setEnv(env: string, alias?: string): ApiBase;
+    /**
+     * Origin (`scheme://host[:port]`) of the API this client talks to, for the current env/alias.
+     * Used to validate the `origin` of postMessages the API itself sends to the page.
+     */
+    getApiOrigin(): string;
+    static toOrigin(url: string): string;
     requestObservable<Req extends object, Res>(method: 'GET' | 'POST', url: string, requestBody: Req): Observable<Res>;
     private makeRequest;
     private onRequestLoad;
@@ -2301,6 +2351,11 @@ declare class Standalone3dsService {
     load(token: string, options: {
         title: string;
     }): void;
+    /**
+     * Origins allowed to deliver a processed 3DS outcome to the page via postMessage: the Paydock API
+     * (inline callback page) and the Paydock widget (remote-app landing page), for the current env/alias.
+     */
+    protected getTrustedMessageOrigins(api: ApiBase): string[];
     setEnv(env: string, alias?: string): void;
 }
 
@@ -2319,6 +2374,38 @@ interface Canvas3dsAuthPayload {
         description?: string;
     };
 }
+/**
+ * Payload of `chargeAuthChallengeLoaded` (Standalone 3DS, challenge flow only).
+ * Emitted exactly once per challenge, after `chargeAuthChallenge`.
+ */
+interface Canvas3dsChallengeLoadedPayload {
+    /** The Paydock 3DS charge identifier the challenge belongs to. */
+    charge_3ds_id: string;
+    /**
+     * `'load'` — the challenge iframe fired its first `load`: the ACS page has painted.
+     * `'timeout'` — no `load` arrived within the SDK's 2.5 s safety fallback; the event is emitted anyway so a
+     * loader is never held forever (the page may still be loading and will paint on its own). Useful for
+     * analytics (how often the fallback fires) — you do not need to handle the two differently.
+     */
+    reason: 'load' | 'timeout';
+}
+/**
+ * Payload of `chargeAuthChallengeCompleted` (Standalone 3DS, challenge and decoupled flows).
+ * Emitted at most once per authentication, after the shopper finished the challenge (or approved a decoupled
+ * authentication) and always before the terminal event.
+ */
+interface Canvas3dsChallengeCompletedPayload {
+    /** The Paydock 3DS charge identifier the authentication belongs to. */
+    charge_3ds_id: string;
+    /**
+     * How the SDK learned that the issuer delivered the result:
+     * `'poll'` — the 3DS Server's result monitor reported it (the usual case: it flips as soon as the issuer's
+     * result reaches the 3DS Server, before the challenge iframe has even left the bank's page);
+     * `'callback'` — the callback message carrying the outcome arrived first (the terminal event follows
+     * immediately). Informational only — handle both the same way.
+     */
+    source: 'poll' | 'callback';
+}
 /**
  * Payload emitted by the Standalone 3DS flow for error events.
  * `error` is intentionally `unknown` — upstream emitters do not guarantee a shape.
@@ -2371,6 +2458,24 @@ interface Canvas3dsEventMap {
     error: Canvas3dsErrorPayload | Canvas3dsErrorEventPayload;
     /** Challenge required — issuer demands user interaction (OTP, biometric, etc.). Standalone-only. */
     chargeAuthChallenge: Canvas3dsAuthPayload;
+    /**
+     * The challenge iframe has painted (first `load`), or the 2.5 s fallback elapsed — see `reason`. Standalone-only,
+     * challenge flow only (never emitted for decoupled challenges). Fires once, after `chargeAuthChallenge`.
+     *
+     * Recommended loader pattern: show a loader before the charge POST, keep it through `chargeAuthChallenge`,
+     * reveal the challenge on this event, cover it with "Completing verification" on `chargeAuthChallengeCompleted`,
+     * and finish on `chargeAuthSuccess` / `chargeAuthReject` / `error`.
+     */
+    chargeAuthChallengeLoaded: Canvas3dsChallengeLoadedPayload;
+    /**
+     * The shopper finished the challenge (or approved a decoupled authentication): the issuer delivered the final
+     * result to the 3DS Server and the SDK is obtaining the outcome. Cover the challenge iframe with your own
+     * "Completing verification" state — whatever the bank or the 3DS Server render from here on is plumbing, not
+     * UX. Standalone-only. Fires at most once per authentication, always before `chargeAuthSuccess` /
+     * `chargeAuthReject` / `error`, and never after them. A wrong OTP or a further interactive step does NOT fire
+     * it (no result has been delivered yet), so no grace timer or reveal fallback is needed on your side.
+     */
+    chargeAuthChallengeCompleted: Canvas3dsChallengeCompletedPayload;
     /** Decoupled authentication — issuer will authenticate out-of-band and notify later. Standalone-only. */
     chargeAuthDecoupled: Canvas3dsAuthPayload;
     /** Iframe-path authentication event. Extends `IEventData` with optional 3DS correlation fields (`charge_3ds_id`, `status`). */
@@ -2426,11 +2531,13 @@ declare enum TOKEN_FORMAT {
  * @const STANDALONE_3DS_EVENT
  *
  * @type {object}
- * @param {string} CHARGE_AUTH_SUCCESS=chargeAuthSuccess
- * @param {string} CHARGE_AUTH_REJECT=chargeAuthReject
- * @param {string} CHARGE_AUTH_DECOUPLED=chargeAuthDecoupled
- * @param {string} CHARGE_AUTH_CHALLENGE=chargeAuthChallenge
- * @param {string} CHARGE_AUTH_INFO=chargeAuthInfo
+ * @param {string} AUTH_SUCCESS=chargeAuthSuccess
+ * @param {string} AUTH_ERROR=chargeAuthReject
+ * @param {string} DECOUPLED=chargeAuthDecoupled
+ * @param {string} CHALLENGE=chargeAuthChallenge
+ * @param {string} CHALLENGE_LOADED=chargeAuthChallengeLoaded - challenge iframe painted (first `load`, or 2.5 s fallback); reveal your challenge UI here
+ * @param {string} CHALLENGE_COMPLETED=chargeAuthChallengeCompleted - the shopper finished the challenge (issuer result delivered to the 3DS Server); cover the challenge iframe with your own loader until the terminal event
+ * @param {string} INFO=chargeAuthInfo
  * @param {string} ERROR=error
  */
 /**
@@ -2559,7 +2666,6 @@ declare class ApiChargeInternal {
     constructor(api: ApiInternal);
     walletCapture(payload: WalletCaptureBody): Promise<WalletCaptureResponse>;
     walletCallback(payload: WalletCallbackBody): Promise<WalletCallbackResponse>;
-    standalone3dsProcess(payload: Standalone3dsProcessBody): Promise<ProcessAuthenticationResponse>;
     standalone3dsHandle(): Promise<HandleResponseInterface>;
 }
 interface WalletCaptureResponse {
@@ -2600,9 +2706,6 @@ interface WalletCallbackResponse {
     callback_rel: string;
     callback_url: string;
 }
-interface Standalone3dsProcessBody {
-    charge_3ds_id: string;
-}
 
 declare class ApiCheckoutInternal {
     protected api: ApiInternal;
@@ -2885,6 +2988,20 @@ declare const CANVAS_3DS_EVENT: {
     readonly DECOUPLED: "chargeAuthDecoupled";
     /** Challenge required — issuer demands user interaction. Payload: `Canvas3dsAuthPayload`. */
     readonly CHALLENGE: "chargeAuthChallenge";
+    /**
+     * The challenge iframe fired its FIRST `load` after `chargeAuthChallenge` (the ACS page has painted),
+     * or the `CHALLENGE_LOADED_FALLBACK_MS` safety fallback elapsed without one. Emitted exactly once per
+     * challenge; never emitted for a decoupled challenge (no challenge iframe). Payload: `Canvas3dsChallengeLoadedPayload`.
+     */
+    readonly CHALLENGE_LOADED: "chargeAuthChallengeLoaded";
+    /**
+     * The issuer delivered the final authentication result to the 3DS Server (the shopper finished the
+     * challenge, or approved a decoupled authentication) and the SDK is now obtaining the outcome. Emitted at
+     * most once per authentication, always before the terminal event. Detected through the `secondary_url`
+     * result monitor (`source: 'poll'`) or, when the callback message arrives first, right before the outcome
+     * it carries (`source: 'callback'`). Payload: `Canvas3dsChallengeCompletedPayload`.
+     */
+    readonly CHALLENGE_COMPLETED: "chargeAuthChallengeCompleted";
     /** Informational signal emitted by the GPayments flow. Internal — not part of the public typed surface. */
     readonly INFO: "chargeAuthInfo";
     /** Error during the flow (network, parsing, etc.). Payload: `Canvas3dsErrorPayload`. */
@@ -7439,5 +7556,5 @@ declare global {
     }
 }
 
-export { AfterpayCheckoutButton, AfterpayOnSiteMessaging, Api, ApplePayOpenWalletButton, ApplePayWalletButtonExpress, CANVAS_3DS_EVENT, CHECKOUT_BUTTON_EVENT, EVENT$2 as CHECKOUT_EVENT, Canvas3ds, Canvas3dsTokenFormat, Checkout, CheckoutActionCode, ClickToPay, Configuration, ContactShippingEditingMode, ELEMENT, ERROR_OPERATION, EVENT$3 as EVENT, Builder$1 as ExternalCheckoutBuilder, Checker as ExternalCheckoutChecker, FORM_FIELD, FRAUD_PREVENTION_EVENTS, FraudPreventionService, GooglePayOpenWalletButton, HtmlMultiWidget, HtmlPaymentSourceWidget, HtmlWidget, InstructionDebugger, MultiWidget, OpenWalletButtons, PAYMENT_EXPIRED, PAYMENT_FAILURE, PAYMENT_SUCCESSFUL, PAYMENT_TYPE, PURPOSE, PayPalDataCollector, PayPalSavePaymentSourceWidget, Builder as PaymentSourceBuilder, PaymentSourceWidget, PaypalCheckoutButton, PaypalWalletButtonExpress, STYLABLE_ELEMENT, STYLABLE_ELEMENT_STATE, STYLE, SUPPORTED_CARD_TYPES, TEXT, TOKEN_TYPE, TRIGGER, TYPE, VAULT_DISPLAY_STYLE, VaultDisplayWidget, EVENT as WALLET_BUTTONS_EXPRESS_EVENT, WALLET_TYPES, WalletButtons, ZipmoneyCheckoutButton };
-export type { ApplePayAvailabilityOptions, ApplePayAvailabilityResult, ApplePayButtonStyle, ApplePayButtonType, ApplePayCapabilityToken, ApplePayCredentialStatus, ApplePayOpenWalletMeta, ApplePayWalletMeta, AppleShippingType, BaseWalletMeta, Billing, Canvas3dsAuthPayload, Canvas3dsChargeAuthEventPayload, Canvas3dsErrorEventPayload, Canvas3dsErrorPayload, Canvas3dsEventMap, Canvas3dsEventName, CheckoutIntentTokenPayload, CheckoutPaymentExpiredPayload, CheckoutPaymentFailurePayload, CheckoutPaymentSuccessPayload, CheckoutResponse, CreateOTTData, CreateOTTRequest, CreateOTTResponse, CreateSessionRequest, CreateSessionResponse, EventTypes, FraudPreventionEvent, FraudPreventionEventType, FraudPreventionProvider, GooglePayAvailabilityOptions, GooglePayAvailabilityResult, GooglePayCardConfig, GooglePayOpenWalletMeta, GooglePayOpenWalletMetaStyles, HandleResponseInterface, IApplePayShippingOption, ICheckout, IClickToPayMeta, IDetails, IElementStyleInput, IEventAfterLoadData, IEventCheckoutFinishData, IEventData$1 as IEventData, IEventError, IEventFinishData, IEventMetaData, IEventSizeData, IFormValidation, IOpenWalletProvider, IPayPalMeta, IStyles$1 as IStyles, ITexts, ITokenStandalone3DS, IWalletMeta, IWalletOnClickEvent, IWalletPaymentSuccessfulEvent, IWalletUnavailableEvent, IWalletUpdateData, IWalletUpdateEvent, OTTResponse, OnCancelEventData, OnClickEventData$1 as OnClickEventData, OnCreateOTTErrorEventData, OnCreateOTTErrorPayload, OnCreateOTTSuccessPayload, OnCreateOTTSuccessfulEventData, OnErrorEventData$1 as OnErrorEventData, OnErrorPayload, OnLoadedEventData, OnUnavailableDetails, OnUnavailableEventData$1 as OnUnavailableEventData, OnUnavailablePayload, OpenWalletAvailabilityOptions, OpenWalletAvailabilityResult, OpenWalletBaseEvent, OpenWalletDataEvent, OpenWalletEventType, OpenWalletMeta, PaypalWalletMeta, ProcessAuthenticationResponse, Shipping, VaultDisplayStyle, OnClickEventData as WalletExpressOnClickEventData, OnCloseEventData as WalletExpressOnCloseEventData, OnErrorEventData as WalletExpressOnErrorEventData, OnPaymentErrorEventData as WalletExpressOnPaymentErrorEventData, OnPaymentInReviewEventData as WalletExpressOnPaymentInReviewEventData, OnPaymentSuccessfulEventData as WalletExpressOnPaymentSuccessfulEventData, OnShippingAddressChangeEventData as WalletExpressOnShippingAddressChangeEventData, OnShippingAddressChangeEventResponse as WalletExpressOnShippingAddressChangeEventResponse, OnShippingOptionChangeEventData as WalletExpressOnShippingOptionChangeEventData, OnShippingOptionChangeEventResponse as WalletExpressOnShippingOptionChangeEventResponse, OnUnavailableEventData as WalletExpressOnUnavailableEventData, WalletType, WidgetEventMap, WidgetEventName };
+export { AfterpayCheckoutButton, AfterpayOnSiteMessaging, Api, ApplePayOpenWalletButton, ApplePayWalletButtonExpress, CANVAS_3DS_EVENT, CARD_SCHEME, CHECKOUT_BUTTON_EVENT, EVENT$2 as CHECKOUT_EVENT, Canvas3ds, Canvas3dsTokenFormat, Checkout, CheckoutActionCode, ClickToPay, Configuration, ContactShippingEditingMode, ELEMENT, ERROR_OPERATION, EVENT$3 as EVENT, Builder$1 as ExternalCheckoutBuilder, Checker as ExternalCheckoutChecker, FORM_FIELD, FRAUD_PREVENTION_EVENTS, FraudPreventionService, GooglePayOpenWalletButton, HtmlMultiWidget, HtmlPaymentSourceWidget, HtmlWidget, InstructionDebugger, MultiWidget, OpenWalletButtons, PAYMENT_EXPIRED, PAYMENT_FAILURE, PAYMENT_SUCCESSFUL, PAYMENT_TYPE, PURPOSE, PayPalDataCollector, PayPalSavePaymentSourceWidget, Builder as PaymentSourceBuilder, PaymentSourceWidget, PaypalCheckoutButton, PaypalWalletButtonExpress, STYLABLE_ELEMENT, STYLABLE_ELEMENT_STATE, STYLE, SUPPORTED_CARD_TYPES, TEXT, TOKEN_TYPE, TRIGGER, TYPE, VAULT_DISPLAY_STYLE, VaultDisplayWidget, EVENT as WALLET_BUTTONS_EXPRESS_EVENT, WALLET_TYPES, WalletButtons, ZipmoneyCheckoutButton };
+export type { ApplePayAvailabilityOptions, ApplePayAvailabilityResult, ApplePayButtonStyle, ApplePayButtonType, ApplePayCapabilityToken, ApplePayCredentialStatus, ApplePayOpenWalletMeta, ApplePayWalletMeta, AppleShippingType, BaseWalletMeta, Billing, Canvas3dsAuthPayload, Canvas3dsChallengeCompletedPayload, Canvas3dsChallengeLoadedPayload, Canvas3dsChargeAuthEventPayload, Canvas3dsErrorEventPayload, Canvas3dsErrorPayload, Canvas3dsEventMap, Canvas3dsEventName, CheckoutIntentTokenPayload, CheckoutPaymentExpiredPayload, CheckoutPaymentFailurePayload, CheckoutPaymentSuccessPayload, CheckoutResponse, CreateOTTData, CreateOTTRequest, CreateOTTResponse, CreateSessionRequest, CreateSessionResponse, EventTypes, FraudPreventionEvent, FraudPreventionEventType, FraudPreventionProvider, GooglePayAvailabilityOptions, GooglePayAvailabilityResult, GooglePayCardConfig, GooglePayOpenWalletMeta, GooglePayOpenWalletMetaStyles, HandleResponseInterface, IApplePayShippingOption, ICheckout, IClickToPayMeta, IDetails, IElementStyleInput, IEventAfterLoadData, IEventCheckoutFinishData, IEventData$1 as IEventData, IEventError, IEventFinishData, IEventMetaData, IEventSizeData, IFormValidation, IOpenWalletProvider, IPayPalMeta, IStyles$1 as IStyles, ITexts, ITokenStandalone3DS, IWalletMeta, IWalletOnClickEvent, IWalletPaymentSuccessfulEvent, IWalletUnavailableEvent, IWalletUpdateData, IWalletUpdateEvent, OTTResponse, OnCancelEventData, OnClickEventData$1 as OnClickEventData, OnCreateOTTErrorEventData, OnCreateOTTErrorPayload, OnCreateOTTSuccessPayload, OnCreateOTTSuccessfulEventData, OnErrorEventData$1 as OnErrorEventData, OnErrorPayload, OnLoadedEventData, OnUnavailableDetails, OnUnavailableEventData$1 as OnUnavailableEventData, OnUnavailablePayload, OpenWalletAvailabilityOptions, OpenWalletAvailabilityResult, OpenWalletBaseEvent, OpenWalletDataEvent, OpenWalletEventType, OpenWalletMeta, PaypalWalletMeta, ProcessAuthenticationResponse, Shipping, VaultDisplayStyle, OnClickEventData as WalletExpressOnClickEventData, OnCloseEventData as WalletExpressOnCloseEventData, OnErrorEventData as WalletExpressOnErrorEventData, OnPaymentErrorEventData as WalletExpressOnPaymentErrorEventData, OnPaymentInReviewEventData as WalletExpressOnPaymentInReviewEventData, OnPaymentSuccessfulEventData as WalletExpressOnPaymentSuccessfulEventData, OnShippingAddressChangeEventData as WalletExpressOnShippingAddressChangeEventData, OnShippingAddressChangeEventResponse as WalletExpressOnShippingAddressChangeEventResponse, OnShippingOptionChangeEventData as WalletExpressOnShippingOptionChangeEventData, OnShippingOptionChangeEventResponse as WalletExpressOnShippingOptionChangeEventResponse, OnUnavailableEventData as WalletExpressOnUnavailableEventData, WalletType, WidgetEventMap, WidgetEventName };

package/bundles/widget.umd.js.min.d.ts

@@ -259,6 +259,24 @@ declare const SUPPORTED_CARD_TYPES: {
     EFTPOS_WHITE: string;
     UNIONPAY: string;
 };
+/**
+ * Card schemes the widget is able to resolve from a card number, and therefore the only values
+ * `setAllowedCardSchemes` accepts. This is a separate vocabulary from SUPPORTED_CARD_TYPES, which drives the
+ * card icons: it omits the icon-only variants `visa_white` / `eftpos_white`, and the `laser` / `maestro`
+ * identifiers the widget can never resolve — allowing those would be configuration that can never match.
+ */
+declare const CARD_SCHEME: {
+    AMEX: string;
+    AUSBC: string;
+    DINERS: string;
+    DISCOVER: string;
+    EFTPOS: string;
+    JAPCB: string;
+    MASTERCARD: string;
+    SOLO: string;
+    UNIONPAY: string;
+    VISA: string;
+};
 interface IIcons {
     paypal_checkout_button?: string;
     afterpay_checkout_button?: string;
@@ -362,6 +380,7 @@ interface IParams extends IStyles$1, ITexts, ICommonParams {
     ref_id?: string;
     supported_card_types?: string;
     validate_card_types?: boolean;
+    allowed_card_schemes?: string;
     fields_validation?: boolean;
     hidden_elements?: string;
     icons?: string;
@@ -767,10 +786,15 @@ declare class Configuration {
 declare class IFrame {
     protected container: Container;
     constructor(container: Container);
+    /**
+     * @param options.onLoad Called on every `load` of the iframe (initial document and each
+     *        subsequent navigation). Attached before `src` is set so a fast load is never missed.
+     */
     load(link: string, options?: {
         title?: string;
         attributes?: Record<string, string>;
         styles?: Record<string, string>;
+        onLoad?: (event: Event) => void;
     }, iframeClass?: string): void;
     loadFromHtml(content: string, options?: {
         title?: string;
@@ -842,15 +866,16 @@ declare const EVENT$3: {
 type EventTypes = typeof EVENT$3[keyof typeof EVENT$3];
 interface Listener {
     event: string;
-    listener: (event: any) => void;
+    /** `origin` is the `MessageEvent.origin` of the postMessage that carried the data (undefined for direct `emit`). */
+    listener: (event: any, origin?: string) => void;
     widget_id: string;
 }
 declare type Listeners = Listener[];
 declare class IFrameEvent {
     protected listeners: Listeners;
     constructor(subject: Window | null);
-    emit(data: IEventData$1): void;
-    on<T>(eventName: string, widgetId: string, cb: (data: T) => void): void;
+    emit(data: IEventData$1, origin?: string): void;
+    on<T>(eventName: string, widgetId: string, cb: (data: T, origin?: string) => void): void;
     clear(): void;
     private subscribe;
 }
@@ -1206,6 +1231,25 @@ declare class MultiWidget {
      * @param {boolean} validateCardNumberInput - [validateCardNumberInput=false] - using this param you allow validation for card number input on supported card types
      */
     setSupportedCardIcons(elements: string[], validateCardNumberInput?: boolean): void;
+    /**
+     * Current method restricts which card schemes the card number input accepts, without changing which card
+     * icons the widget displays. Scheme identifiers are matched case-insensitively and ignoring surrounding
+     * whitespace; unsupported identifiers are ignored with a warning, so a list in which every identifier is
+     * unsupported applies no restriction at all.
+     *
+     * Takes precedence over setSupportedCardIcons: when a non-empty list is supplied here, it is the only list
+     * used for validation and the validateCardNumberInput flag of setSupportedCardIcons no longer affects it.
+     * Calling this method more than once replaces the previous list rather than merging with it.
+     *
+     * Must be called before load().
+     *
+     * @example
+     *
+     * widget.setAllowedCardSchemes(['visa', 'mastercard']);
+     *
+     * @param {string[]} schemes - [CARD_SCHEME]{@link CARD_SCHEME}
+     */
+    setAllowedCardSchemes(schemes: string[]): void;
     /**
      * Current method can hide prevent the widget from showing the error messages
      *
@@ -2171,6 +2215,12 @@ declare class ApiBase {
      * @param {string} [alias] - Own domain alias
      */
     setEnv(env: string, alias?: string): ApiBase;
+    /**
+     * Origin (`scheme://host[:port]`) of the API this client talks to, for the current env/alias.
+     * Used to validate the `origin` of postMessages the API itself sends to the page.
+     */
+    getApiOrigin(): string;
+    static toOrigin(url: string): string;
     requestObservable<Req extends object, Res>(method: 'GET' | 'POST', url: string, requestBody: Req): Observable<Res>;
     private makeRequest;
     private onRequestLoad;
@@ -2301,6 +2351,11 @@ declare class Standalone3dsService {
     load(token: string, options: {
         title: string;
     }): void;
+    /**
+     * Origins allowed to deliver a processed 3DS outcome to the page via postMessage: the Paydock API
+     * (inline callback page) and the Paydock widget (remote-app landing page), for the current env/alias.
+     */
+    protected getTrustedMessageOrigins(api: ApiBase): string[];
     setEnv(env: string, alias?: string): void;
 }
 
@@ -2319,6 +2374,38 @@ interface Canvas3dsAuthPayload {
         description?: string;
     };
 }
+/**
+ * Payload of `chargeAuthChallengeLoaded` (Standalone 3DS, challenge flow only).
+ * Emitted exactly once per challenge, after `chargeAuthChallenge`.
+ */
+interface Canvas3dsChallengeLoadedPayload {
+    /** The Paydock 3DS charge identifier the challenge belongs to. */
+    charge_3ds_id: string;
+    /**
+     * `'load'` — the challenge iframe fired its first `load`: the ACS page has painted.
+     * `'timeout'` — no `load` arrived within the SDK's 2.5 s safety fallback; the event is emitted anyway so a
+     * loader is never held forever (the page may still be loading and will paint on its own). Useful for
+     * analytics (how often the fallback fires) — you do not need to handle the two differently.
+     */
+    reason: 'load' | 'timeout';
+}
+/**
+ * Payload of `chargeAuthChallengeCompleted` (Standalone 3DS, challenge and decoupled flows).
+ * Emitted at most once per authentication, after the shopper finished the challenge (or approved a decoupled
+ * authentication) and always before the terminal event.
+ */
+interface Canvas3dsChallengeCompletedPayload {
+    /** The Paydock 3DS charge identifier the authentication belongs to. */
+    charge_3ds_id: string;
+    /**
+     * How the SDK learned that the issuer delivered the result:
+     * `'poll'` — the 3DS Server's result monitor reported it (the usual case: it flips as soon as the issuer's
+     * result reaches the 3DS Server, before the challenge iframe has even left the bank's page);
+     * `'callback'` — the callback message carrying the outcome arrived first (the terminal event follows
+     * immediately). Informational only — handle both the same way.
+     */
+    source: 'poll' | 'callback';
+}
 /**
  * Payload emitted by the Standalone 3DS flow for error events.
  * `error` is intentionally `unknown` — upstream emitters do not guarantee a shape.
@@ -2371,6 +2458,24 @@ interface Canvas3dsEventMap {
     error: Canvas3dsErrorPayload | Canvas3dsErrorEventPayload;
     /** Challenge required — issuer demands user interaction (OTP, biometric, etc.). Standalone-only. */
     chargeAuthChallenge: Canvas3dsAuthPayload;
+    /**
+     * The challenge iframe has painted (first `load`), or the 2.5 s fallback elapsed — see `reason`. Standalone-only,
+     * challenge flow only (never emitted for decoupled challenges). Fires once, after `chargeAuthChallenge`.
+     *
+     * Recommended loader pattern: show a loader before the charge POST, keep it through `chargeAuthChallenge`,
+     * reveal the challenge on this event, cover it with "Completing verification" on `chargeAuthChallengeCompleted`,
+     * and finish on `chargeAuthSuccess` / `chargeAuthReject` / `error`.
+     */
+    chargeAuthChallengeLoaded: Canvas3dsChallengeLoadedPayload;
+    /**
+     * The shopper finished the challenge (or approved a decoupled authentication): the issuer delivered the final
+     * result to the 3DS Server and the SDK is obtaining the outcome. Cover the challenge iframe with your own
+     * "Completing verification" state — whatever the bank or the 3DS Server render from here on is plumbing, not
+     * UX. Standalone-only. Fires at most once per authentication, always before `chargeAuthSuccess` /
+     * `chargeAuthReject` / `error`, and never after them. A wrong OTP or a further interactive step does NOT fire
+     * it (no result has been delivered yet), so no grace timer or reveal fallback is needed on your side.
+     */
+    chargeAuthChallengeCompleted: Canvas3dsChallengeCompletedPayload;
     /** Decoupled authentication — issuer will authenticate out-of-band and notify later. Standalone-only. */
     chargeAuthDecoupled: Canvas3dsAuthPayload;
     /** Iframe-path authentication event. Extends `IEventData` with optional 3DS correlation fields (`charge_3ds_id`, `status`). */
@@ -2426,11 +2531,13 @@ declare enum TOKEN_FORMAT {
  * @const STANDALONE_3DS_EVENT
  *
  * @type {object}
- * @param {string} CHARGE_AUTH_SUCCESS=chargeAuthSuccess
- * @param {string} CHARGE_AUTH_REJECT=chargeAuthReject
- * @param {string} CHARGE_AUTH_DECOUPLED=chargeAuthDecoupled
- * @param {string} CHARGE_AUTH_CHALLENGE=chargeAuthChallenge
- * @param {string} CHARGE_AUTH_INFO=chargeAuthInfo
+ * @param {string} AUTH_SUCCESS=chargeAuthSuccess
+ * @param {string} AUTH_ERROR=chargeAuthReject
+ * @param {string} DECOUPLED=chargeAuthDecoupled
+ * @param {string} CHALLENGE=chargeAuthChallenge
+ * @param {string} CHALLENGE_LOADED=chargeAuthChallengeLoaded - challenge iframe painted (first `load`, or 2.5 s fallback); reveal your challenge UI here
+ * @param {string} CHALLENGE_COMPLETED=chargeAuthChallengeCompleted - the shopper finished the challenge (issuer result delivered to the 3DS Server); cover the challenge iframe with your own loader until the terminal event
+ * @param {string} INFO=chargeAuthInfo
  * @param {string} ERROR=error
  */
 /**
@@ -2559,7 +2666,6 @@ declare class ApiChargeInternal {
     constructor(api: ApiInternal);
     walletCapture(payload: WalletCaptureBody): Promise<WalletCaptureResponse>;
     walletCallback(payload: WalletCallbackBody): Promise<WalletCallbackResponse>;
-    standalone3dsProcess(payload: Standalone3dsProcessBody): Promise<ProcessAuthenticationResponse>;
     standalone3dsHandle(): Promise<HandleResponseInterface>;
 }
 interface WalletCaptureResponse {
@@ -2600,9 +2706,6 @@ interface WalletCallbackResponse {
     callback_rel: string;
     callback_url: string;
 }
-interface Standalone3dsProcessBody {
-    charge_3ds_id: string;
-}
 
 declare class ApiCheckoutInternal {
     protected api: ApiInternal;
@@ -2885,6 +2988,20 @@ declare const CANVAS_3DS_EVENT: {
     readonly DECOUPLED: "chargeAuthDecoupled";
     /** Challenge required — issuer demands user interaction. Payload: `Canvas3dsAuthPayload`. */
     readonly CHALLENGE: "chargeAuthChallenge";
+    /**
+     * The challenge iframe fired its FIRST `load` after `chargeAuthChallenge` (the ACS page has painted),
+     * or the `CHALLENGE_LOADED_FALLBACK_MS` safety fallback elapsed without one. Emitted exactly once per
+     * challenge; never emitted for a decoupled challenge (no challenge iframe). Payload: `Canvas3dsChallengeLoadedPayload`.
+     */
+    readonly CHALLENGE_LOADED: "chargeAuthChallengeLoaded";
+    /**
+     * The issuer delivered the final authentication result to the 3DS Server (the shopper finished the
+     * challenge, or approved a decoupled authentication) and the SDK is now obtaining the outcome. Emitted at
+     * most once per authentication, always before the terminal event. Detected through the `secondary_url`
+     * result monitor (`source: 'poll'`) or, when the callback message arrives first, right before the outcome
+     * it carries (`source: 'callback'`). Payload: `Canvas3dsChallengeCompletedPayload`.
+     */
+    readonly CHALLENGE_COMPLETED: "chargeAuthChallengeCompleted";
     /** Informational signal emitted by the GPayments flow. Internal — not part of the public typed surface. */
     readonly INFO: "chargeAuthInfo";
     /** Error during the flow (network, parsing, etc.). Payload: `Canvas3dsErrorPayload`. */
@@ -7439,5 +7556,5 @@ declare global {
     }
 }
 
-export { AfterpayCheckoutButton, AfterpayOnSiteMessaging, Api, ApplePayOpenWalletButton, ApplePayWalletButtonExpress, CANVAS_3DS_EVENT, CHECKOUT_BUTTON_EVENT, EVENT$2 as CHECKOUT_EVENT, Canvas3ds, Canvas3dsTokenFormat, Checkout, CheckoutActionCode, ClickToPay, Configuration, ContactShippingEditingMode, ELEMENT, ERROR_OPERATION, EVENT$3 as EVENT, Builder$1 as ExternalCheckoutBuilder, Checker as ExternalCheckoutChecker, FORM_FIELD, FRAUD_PREVENTION_EVENTS, FraudPreventionService, GooglePayOpenWalletButton, HtmlMultiWidget, HtmlPaymentSourceWidget, HtmlWidget, InstructionDebugger, MultiWidget, OpenWalletButtons, PAYMENT_EXPIRED, PAYMENT_FAILURE, PAYMENT_SUCCESSFUL, PAYMENT_TYPE, PURPOSE, PayPalDataCollector, PayPalSavePaymentSourceWidget, Builder as PaymentSourceBuilder, PaymentSourceWidget, PaypalCheckoutButton, PaypalWalletButtonExpress, STYLABLE_ELEMENT, STYLABLE_ELEMENT_STATE, STYLE, SUPPORTED_CARD_TYPES, TEXT, TOKEN_TYPE, TRIGGER, TYPE, VAULT_DISPLAY_STYLE, VaultDisplayWidget, EVENT as WALLET_BUTTONS_EXPRESS_EVENT, WALLET_TYPES, WalletButtons, ZipmoneyCheckoutButton };
-export type { ApplePayAvailabilityOptions, ApplePayAvailabilityResult, ApplePayButtonStyle, ApplePayButtonType, ApplePayCapabilityToken, ApplePayCredentialStatus, ApplePayOpenWalletMeta, ApplePayWalletMeta, AppleShippingType, BaseWalletMeta, Billing, Canvas3dsAuthPayload, Canvas3dsChargeAuthEventPayload, Canvas3dsErrorEventPayload, Canvas3dsErrorPayload, Canvas3dsEventMap, Canvas3dsEventName, CheckoutIntentTokenPayload, CheckoutPaymentExpiredPayload, CheckoutPaymentFailurePayload, CheckoutPaymentSuccessPayload, CheckoutResponse, CreateOTTData, CreateOTTRequest, CreateOTTResponse, CreateSessionRequest, CreateSessionResponse, EventTypes, FraudPreventionEvent, FraudPreventionEventType, FraudPreventionProvider, GooglePayAvailabilityOptions, GooglePayAvailabilityResult, GooglePayCardConfig, GooglePayOpenWalletMeta, GooglePayOpenWalletMetaStyles, HandleResponseInterface, IApplePayShippingOption, ICheckout, IClickToPayMeta, IDetails, IElementStyleInput, IEventAfterLoadData, IEventCheckoutFinishData, IEventData$1 as IEventData, IEventError, IEventFinishData, IEventMetaData, IEventSizeData, IFormValidation, IOpenWalletProvider, IPayPalMeta, IStyles$1 as IStyles, ITexts, ITokenStandalone3DS, IWalletMeta, IWalletOnClickEvent, IWalletPaymentSuccessfulEvent, IWalletUnavailableEvent, IWalletUpdateData, IWalletUpdateEvent, OTTResponse, OnCancelEventData, OnClickEventData$1 as OnClickEventData, OnCreateOTTErrorEventData, OnCreateOTTErrorPayload, OnCreateOTTSuccessPayload, OnCreateOTTSuccessfulEventData, OnErrorEventData$1 as OnErrorEventData, OnErrorPayload, OnLoadedEventData, OnUnavailableDetails, OnUnavailableEventData$1 as OnUnavailableEventData, OnUnavailablePayload, OpenWalletAvailabilityOptions, OpenWalletAvailabilityResult, OpenWalletBaseEvent, OpenWalletDataEvent, OpenWalletEventType, OpenWalletMeta, PaypalWalletMeta, ProcessAuthenticationResponse, Shipping, VaultDisplayStyle, OnClickEventData as WalletExpressOnClickEventData, OnCloseEventData as WalletExpressOnCloseEventData, OnErrorEventData as WalletExpressOnErrorEventData, OnPaymentErrorEventData as WalletExpressOnPaymentErrorEventData, OnPaymentInReviewEventData as WalletExpressOnPaymentInReviewEventData, OnPaymentSuccessfulEventData as WalletExpressOnPaymentSuccessfulEventData, OnShippingAddressChangeEventData as WalletExpressOnShippingAddressChangeEventData, OnShippingAddressChangeEventResponse as WalletExpressOnShippingAddressChangeEventResponse, OnShippingOptionChangeEventData as WalletExpressOnShippingOptionChangeEventData, OnShippingOptionChangeEventResponse as WalletExpressOnShippingOptionChangeEventResponse, OnUnavailableEventData as WalletExpressOnUnavailableEventData, WalletType, WidgetEventMap, WidgetEventName };
+export { AfterpayCheckoutButton, AfterpayOnSiteMessaging, Api, ApplePayOpenWalletButton, ApplePayWalletButtonExpress, CANVAS_3DS_EVENT, CARD_SCHEME, CHECKOUT_BUTTON_EVENT, EVENT$2 as CHECKOUT_EVENT, Canvas3ds, Canvas3dsTokenFormat, Checkout, CheckoutActionCode, ClickToPay, Configuration, ContactShippingEditingMode, ELEMENT, ERROR_OPERATION, EVENT$3 as EVENT, Builder$1 as ExternalCheckoutBuilder, Checker as ExternalCheckoutChecker, FORM_FIELD, FRAUD_PREVENTION_EVENTS, FraudPreventionService, GooglePayOpenWalletButton, HtmlMultiWidget, HtmlPaymentSourceWidget, HtmlWidget, InstructionDebugger, MultiWidget, OpenWalletButtons, PAYMENT_EXPIRED, PAYMENT_FAILURE, PAYMENT_SUCCESSFUL, PAYMENT_TYPE, PURPOSE, PayPalDataCollector, PayPalSavePaymentSourceWidget, Builder as PaymentSourceBuilder, PaymentSourceWidget, PaypalCheckoutButton, PaypalWalletButtonExpress, STYLABLE_ELEMENT, STYLABLE_ELEMENT_STATE, STYLE, SUPPORTED_CARD_TYPES, TEXT, TOKEN_TYPE, TRIGGER, TYPE, VAULT_DISPLAY_STYLE, VaultDisplayWidget, EVENT as WALLET_BUTTONS_EXPRESS_EVENT, WALLET_TYPES, WalletButtons, ZipmoneyCheckoutButton };
+export type { ApplePayAvailabilityOptions, ApplePayAvailabilityResult, ApplePayButtonStyle, ApplePayButtonType, ApplePayCapabilityToken, ApplePayCredentialStatus, ApplePayOpenWalletMeta, ApplePayWalletMeta, AppleShippingType, BaseWalletMeta, Billing, Canvas3dsAuthPayload, Canvas3dsChallengeCompletedPayload, Canvas3dsChallengeLoadedPayload, Canvas3dsChargeAuthEventPayload, Canvas3dsErrorEventPayload, Canvas3dsErrorPayload, Canvas3dsEventMap, Canvas3dsEventName, CheckoutIntentTokenPayload, CheckoutPaymentExpiredPayload, CheckoutPaymentFailurePayload, CheckoutPaymentSuccessPayload, CheckoutResponse, CreateOTTData, CreateOTTRequest, CreateOTTResponse, CreateSessionRequest, CreateSessionResponse, EventTypes, FraudPreventionEvent, FraudPreventionEventType, FraudPreventionProvider, GooglePayAvailabilityOptions, GooglePayAvailabilityResult, GooglePayCardConfig, GooglePayOpenWalletMeta, GooglePayOpenWalletMetaStyles, HandleResponseInterface, IApplePayShippingOption, ICheckout, IClickToPayMeta, IDetails, IElementStyleInput, IEventAfterLoadData, IEventCheckoutFinishData, IEventData$1 as IEventData, IEventError, IEventFinishData, IEventMetaData, IEventSizeData, IFormValidation, IOpenWalletProvider, IPayPalMeta, IStyles$1 as IStyles, ITexts, ITokenStandalone3DS, IWalletMeta, IWalletOnClickEvent, IWalletPaymentSuccessfulEvent, IWalletUnavailableEvent, IWalletUpdateData, IWalletUpdateEvent, OTTResponse, OnCancelEventData, OnClickEventData$1 as OnClickEventData, OnCreateOTTErrorEventData, OnCreateOTTErrorPayload, OnCreateOTTSuccessPayload, OnCreateOTTSuccessfulEventData, OnErrorEventData$1 as OnErrorEventData, OnErrorPayload, OnLoadedEventData, OnUnavailableDetails, OnUnavailableEventData$1 as OnUnavailableEventData, OnUnavailablePayload, OpenWalletAvailabilityOptions, OpenWalletAvailabilityResult, OpenWalletBaseEvent, OpenWalletDataEvent, OpenWalletEventType, OpenWalletMeta, PaypalWalletMeta, ProcessAuthenticationResponse, Shipping, VaultDisplayStyle, OnClickEventData as WalletExpressOnClickEventData, OnCloseEventData as WalletExpressOnCloseEventData, OnErrorEventData as WalletExpressOnErrorEventData, OnPaymentErrorEventData as WalletExpressOnPaymentErrorEventData, OnPaymentInReviewEventData as WalletExpressOnPaymentInReviewEventData, OnPaymentSuccessfulEventData as WalletExpressOnPaymentSuccessfulEventData, OnShippingAddressChangeEventData as WalletExpressOnShippingAddressChangeEventData, OnShippingAddressChangeEventResponse as WalletExpressOnShippingAddressChangeEventResponse, OnShippingOptionChangeEventData as WalletExpressOnShippingOptionChangeEventData, OnShippingOptionChangeEventResponse as WalletExpressOnShippingOptionChangeEventResponse, OnUnavailableEventData as WalletExpressOnUnavailableEventData, WalletType, WidgetEventMap, WidgetEventName };